Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-05-13T15:17:12 urllib3: urllib3: Denial of Service due to excessive HTTP response decompression 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-409

A flaw was found in urllib3, an HTTP client library for Python. This vulnerability allows a remote attacker to cause excessive resource consumption, such as high CPU usage and massive memory allocation, on the client side. This occurs when urllib3 attempts to decompress an entire HTTP response, even if only a partial read was requested, or when draining the connection after a partial decompression. This can lead to a Denial of Service (DoS) condition.

Red Hat Discovery 2 2026-05-21T00:00:00Z RHSA-2026:20338 discovery/discovery-server-rhel9:1779395228 Exploit Intelligence Not affected exploit-intelligence-tech-preview/vulnerability-analysis-rhel9 External Secrets Operator for Red Hat OpenShift Not affected external-secrets-operator/bitwarden-sdk-server-rhel9 External Secrets Operator for Red Hat OpenShift Not affected external-secrets-operator/external-secrets-operator-bundle External Secrets Operator for Red Hat OpenShift Not affected external-secrets-operator/external-secrets-operator-rhel9 External Secrets Operator for Red Hat OpenShift Not affected external-secrets-operator/external-secrets-rhel9 Migration Toolkit for Applications 8 Affected mta/mta-rhel9-operator Migration Toolkit for Applications 8 Affected mta/mta-solution-server-rhel9 Migration Toolkit for Containers Not affected rhmtc/openshift-migration-rhel8-operator Migration Toolkit for Virtualization Not affected migration-toolkit-virtualization/mtv-rhel9-operator Migration Toolkit for Virtualization Not affected mtv-candidate/mtv-rhel9-operator OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-ocp-rag-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-service-api-rhel9 OpenShift Lightspeed Affected openshift-lightspeed/lightspeed-to-dataverse-exporter-rhel9 OpenShift Service Mesh 3 Not affected openshift-service-mesh/kiali-rhel9-operator Pen Drive Powered by Red Hat Lightspeed Affected pen-drive/pen-drive-scanner-rhel9 Pen Drive Powered by Red Hat Lightspeed Not affected pen-drive/pen-drive-scanner-rhel9 Red Hat AI Inference Server Affected rhaiis/model-opt-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cpu-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-cuda-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-neuron-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-rocm-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-spyre-rhel9 Red Hat AI Inference Server Affected rhaiis/vllm-tpu-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-25/ee-supported-rhel8 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-25/lightspeed-chatbot-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/controller-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/controller-rhel9-operator Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/de-minimal-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/de-supported-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/eda-controller-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/eda-controller-rhel9-operator Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/ee-minimal-rhel9 Red Hat Ansible Automation Platform 2 Not affected ansible-automation-platform-26/ee-supported-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/gateway-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/gateway-rhel9-operator Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/hub-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/hub-rhel9-operator Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/lightspeed-chatbot-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/lightspeed-rhel9-operator Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/platform-resource-rhel9-operator Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/platform-resource-runner-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform/automation-dashboard-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-tech-preview/metrics-service-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-tech-preview/metrics-service-rhel9-operator Red Hat Ansible Automation Platform 2 Affected automation-controller Red Hat Ansible Automation Platform 2 Not affected python-urllib3 Red Hat build of Quarkus Native builder Not affected urllib3 Red Hat Developer Hub Not affected rhdh/rhdh-hub-rhel9 Red Hat Enterprise Linux 10 Not affected python3.14-pip Red Hat Enterprise Linux 10 Not affected python-pip Red Hat Enterprise Linux 10 Not affected python-urllib3 Red Hat Enterprise Linux 6 Not affected python-urllib3 Red Hat Enterprise Linux 7 Not affected python-pip Red Hat Enterprise Linux 7 Not affected python-s3transfer Red Hat Enterprise Linux 7 Not affected python-urllib3 Red Hat Enterprise Linux 8 Not affected fence-agents Red Hat Enterprise Linux 8 Not affected python3.11-pip Red Hat Enterprise Linux 8 Not affected python3.12-pip Red Hat Enterprise Linux 8 Not affected python-pip Red Hat Enterprise Linux 8 Not affected python-urllib3 Red Hat Enterprise Linux 8 Not affected resource-agents Red Hat Enterprise Linux 9 Not affected fence-agents Red Hat Enterprise Linux 9 Not affected python3.11-pip Red Hat Enterprise Linux 9 Not affected python3.12-pip Red Hat Enterprise Linux 9 Not affected python3.14-pip Red Hat Enterprise Linux 9 Not affected python-pip Red Hat Enterprise Linux 9 Not affected python-urllib3 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-aws-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-azure-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-azure-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-gcp-cuda-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/bootc-rocm-rhel9 Red Hat Enterprise Linux AI (RHEL AI) 3 Not affected rhelai3/disk-image-cuda-rhel9 Red Hat Hardened Images Under investigation llvm Red Hat Hardened Images Under investigation llvm21 Red Hat Hardened Images Under investigation mariadb11.8 Red Hat Hardened Images Under investigation python-attrs Red Hat Hardened Images Under investigation python-cryptography Red Hat Hardened Images Under investigation python-rpds-py Red Hat Hardened Images Under investigation python-sentry-sdk Red Hat Hardened Images Under investigation python-urllib3 Red Hat Hardened Images Under investigation rust Red Hat Hardened Images Under investigation trivy Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-built-in-detector-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-caikit-nlp-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-caikit-tgis-serving-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-feature-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-guardrails-detector-huggingface-runtime-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-agent-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-controller-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-kserve-router-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-kserve-storage-initializer-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llama-stack-core-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-llm-d-inference-scheduler-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlflow-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ml-pipelines-runtime-generic-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-mlserver-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-runtime-adapter-rhel8 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-modelmesh-runtime-adapter-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-model-registry-job-async-upload-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-openvino-model-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-pipeline-runtime-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-ta-lmes-job-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda121-torch24-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda124-torch25-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch28-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-cuda128-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm62-torch24-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm62-torch25-py311-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch28-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-training-rocm64-torch29-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 Red Hat OpenShift AI (RHOAI) Not affected rhoai/odh-trustyai-nemo-guardrails-server-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-cuda-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-gaudi-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-vllm-rocm-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-codeserver-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-datascience-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-minimal-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-llmcompressor-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-pytorch-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-cuda-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-tensorflow-rocm-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-workbench-jupyter-trustyai-cpu-py312-rhel9 Red Hat OpenShift AI (RHOAI) Affected rhoai/rhai-cli-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-agent-installer-api-server-rhel9 Red Hat OpenShift Container Platform 4 Affected openshift4/ose-ansible-rhel9-operator Red Hat OpenShift Container Platform 4 Not affected openshift4/ose-olm-catalogd-rhel9 Red Hat OpenShift Container Platform 4 Not affected openshift4/ztp-site-generate-rhel8 Red Hat OpenShift Container Platform 4 Not affected rhcos Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/hyperconverged-cluster-operator-rhel9 Red Hat OpenShift Virtualization 4 Not affected container-native-virtualization/hyperconverged-cluster-webhook-rhel9 Red Hat OpenStack Platform 17.1 Not affected python-urllib3 Red Hat Quay 3 Affected quay/quay-rhel8 Red Hat Quay 3 Affected quay/quay-rhel9 Red Hat Satellite 6 Not affected python-urllib3 Red Hat Satellite 6 Not affected satellite-capsule:el8/python-urllib3 Red Hat Satellite 6 Affected satellite/foreman-mcp-server-rhel9 Red Hat Satellite 6 Affected satellite/iop-advisor-backend-rhel9 Red Hat Satellite 6 Not affected satellite/iop-advisor-engine-rhel9 Red Hat Satellite 6 Not affected satellite/iop-host-inventory-rhel9 Red Hat Satellite 6 Affected satellite/iop-insights-engine-rhel9 Red Hat Satellite 6 Affected satellite/iop-puptoo-rhel9 Red Hat Satellite 6 Affected satellite/iop-vmaas-rhel9 Red Hat Satellite 6 Not affected satellite/iop-vulnerability-engine-rhel9 Red Hat Satellite 6 Affected satellite/iop-yuptoo-rhel9 Red Hat Trusted Artifact Signer Affected rhtas/model-transparency-rhel9 Red Hat Trusted Artifact Signer Affected rhtas/segment-reporting-rhel9 Red Hat Update Infrastructure 4 for Cloud Providers Not affected python-urllib3 Service Telemetry Framework 1.5 Affected stf/service-telemetry-rhel9-operator Service Telemetry Framework 1.5 Affected stf/smart-gateway-rhel9-operator https://www.cve.org/CVERecord?id=CVE-2026-44432 https://nvd.nist.gov/vuln/detail/CVE-2026-44432 https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j