جزئیات آسیب‌پذیری
CVE-2026-44432
Red Hat OpenShift LightspeedRed Hat Pen Drive Powered by Red Hat LightspeedRed Hat AI Inference ServerRed Hat Ansible Automation Platform 2Red Hat OpenShift AIRed Hat OpenShift Container Platform 4
urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API
CVSS 4.0
8.9بالا
شرح رسمی (انگلیسی)
urllib3 is an HTTP client library for Python. From 2.6.0 to before 2.7.0, urllib3 could decompress the whole response instead of the requested portion (1) during the second HTTPResponse.read(amt=N) call when the response was decompressed using the official Brotli library or (2) when HTTPResponse.drain_conn() was called after the response had been read and decompressed partially (compression algorithm did not matter here). These issues could cause urllib3 to fully decode a small amount of highly compressed data in a single operation. This could result in excessive resource consumption (high CPU usage and massive memory allocation for the decompressed data) on the client side. This vulnerability is fixed in 2.7.0.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 8.9بالا | 4.0 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H |
| 7.5بالا | 3.1 | CVEProject cvelistV5 (CNA) (redhat-SADP) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | OpenShift Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Pen Drive Powered by Red Hat Lightspeed | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat AI Inference Server | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat Ansible Automation Platform 2 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift AI (RHOAI) | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Red Hat OpenShift Container Platform 4 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Service Telemetry Framework 1.5 | همه | CVEProject cvelistV5 (CNA) |
| Red Hat | Service Telemetry Framework 1.5 | همه | CVEProject cvelistV5 (CNA) |
| urllib3 | urllib3 | >= 2.6.0, < 2.7.0 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۶۲- https://github.com/urllib3/urllib3/security/advisories/GHSA-mf9v-mfxr-j63j x_refsource_CONFIRM
- https://access.redhat.com/security/cve/CVE-2026-44432 vdb-entryx_refsource_REDHAT
- https://bugzilla.redhat.com/show_bug.cgi?id=2477154 issue-trackingx_refsource_REDHAT
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-44432.json x_sadp-csaf-vex
- https://access.redhat.com/errata/RHSA-2026:42078 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34160 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42079 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:27929 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:32992 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28159 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28157 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28000 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60362 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:60371 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:59409 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28158 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30078 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30089 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30088 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30087 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24542 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24540 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24544 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24541 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42144 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42132 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34374 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25928 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:20338 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33313 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25039 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7634 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24069 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:25143 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24014 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24374 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:7625 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24000 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24009 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:22934 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:15862 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:56347 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:43038 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42644 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:37275 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:33683 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:30076 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:42796 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:41066 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:28571 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:36350 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26304 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:26212 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:51206 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34607 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34531 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34526 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:34533 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24476 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:24483 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:44481 vendor-advisoryx_refsource_REDHAT
- https://access.redhat.com/errata/RHSA-2026:58981 vendor-advisoryx_refsource_REDHAT
هشدار CVEهای بعدی این محصولمحصول را دنبال کنید تا آسیب‌پذیری‌های تازه را در تلگرام بگیرید.
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۲/۲۳
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۶/۱۹
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
۰٫۶۸٪
احتمال بهره‌برداری در ۳۰ روز
۵۲٫۵٪
صدک (نسبت به همه‌ی CVEها)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- جزئی
ضعف‌ها (CWE)
- CWE-409Improper Handling of Highly Compressed Data (Data Amplification)