CVE-2026-44432 is a vulnerability in urllib3, a Python HTTP client library, that allows a remote attacker to cause excessive resource consumption on the client side. The issue arises when urllib3 decompresses an entire HTTP response regardless of partial reads or connection draining, leading to high CPU and memory usage. This improper handling of highly compressed data (CWE-409) can result in a Denial of Service (DoS) condition. Red Hat Hardened Images RPMs including python-cryptography and python3-cryptography packages have been updated to mitigate this vulnerability. The advisory references Red Hat security advisory RHSA-2026:24014 and provides updated package versions for affected architectures.

The vulnerability can cause significant resource exhaustion on affected systems, resulting in degraded performance or system crashes due to high CPU and memory usage. This impacts availability by enabling Denial of Service conditions when processing maliciously crafted HTTP responses. There is no impact on confidentiality or integrity. No known exploits in the wild have been reported at this time.

Red Hat has released updated RPM packages for Red Hat Hardened Images that address this vulnerability. Users should apply the updates as described in Red Hat advisory RHSA-2026:24014, available at https://access.redhat.com/errata/RHSA-2026:24014 and https://images.redhat.com/. No additional mitigations are specified by the vendor. Patch status is confirmed as an official fix available via updated packages.