diff --git a/SOURCES/RHEL-178598-fix-bundled-urllib3-CVE-2026-44431.patch b/SOURCES/RHEL-178598-fix-bundled-urllib3-CVE-2026-44431.patch
new file mode 100644
index 0000000..aa16b2c
--- /dev/null
+++ b/SOURCES/RHEL-178598-fix-bundled-urllib3-CVE-2026-44431.patch
@@ -0,0 +1,43 @@
+--- a/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3/connectionpool.py
++++ b/aliyun/aliyunsdkcore/vendored/requests/packages/urllib3/connectionpool.py
+@@ -850,6 +850,18 @@
+                 body = None
+                 headers = HTTPHeaderDict(headers)._prepare_for_method_change()
+ 
++            # Strip headers marked as unsafe to forward to the redirected location.
++            # Check remove_headers_on_redirect to avoid a potential network call within
++            # self.is_same_host() which may use socket.gethostbyname() in the future.
++            if retries.remove_headers_on_redirect and not self.is_same_host(
++                redirect_location
++            ):
++                new_headers = headers.copy()
++                for header in headers:
++                    if header.lower() in retries.remove_headers_on_redirect:
++                        new_headers.pop(header, None)
++                headers = new_headers
++
+             try:
+                 retries = retries.increment(method, url, response=response, _pool=self)
+             except MaxRetryError:
+
+--- a/gcp/google-cloud-sdk/lib/third_party/urllib3/connectionpool.py
++++ b/gcp/google-cloud-sdk/lib/third_party/urllib3/connectionpool.py
+@@ -850,6 +850,18 @@
+                 body = None
+                 headers = HTTPHeaderDict(headers)._prepare_for_method_change()
+ 
++            # Strip headers marked as unsafe to forward to the redirected location.
++            # Check remove_headers_on_redirect to avoid a potential network call within
++            # self.is_same_host() which may use socket.gethostbyname() in the future.
++            if retries.remove_headers_on_redirect and not self.is_same_host(
++                redirect_location
++            ):
++                new_headers = headers.copy()
++                for header in headers:
++                    if header.lower() in retries.remove_headers_on_redirect:
++                        new_headers.pop(header, None)
++                headers = new_headers
++
+             try:
+                 retries = retries.increment(method, url, response=response, _pool=self)
+             except MaxRetryError:
diff --git a/SPECS/resource-agents.spec b/SPECS/resource-agents.spec
index 58e8def..de550d6 100644
--- a/SPECS/resource-agents.spec
+++ b/SPECS/resource-agents.spec
@@ -73,7 +73,7 @@
 Name:		resource-agents
 Summary:	Open Source HA Reusable Cluster Resource Scripts
 Version:	4.9.0
-Release:	54%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.35.alma.1
+Release:	54%{?rcver:%{rcver}}%{?numcomm:.%{numcomm}}%{?alphatag:.%{alphatag}}%{?dirty:.%{dirty}}%{?dist}.36.alma.1
 License:	GPLv2+ and LGPLv2+
 URL:		https://github.com/ClusterLabs/resource-agents
 %if 0%{?fedora} || 0%{?centos_version} || 0%{?rhel}
@@ -208,6 +208,7 @@ Patch1014:	RHEL-139760-fix-bundled-urllib3-CVE-2025-66471.patch
 Patch1015:	RHEL-140787-RHEL-146289-fix-bundled-urllib3-CVE-2026-21441.patch
 Patch1016:	RHEL-142448-fix-bundled-pyasn1-CVE-2026-23490.patch
 Patch1017:	RHEL-157190-fix-bundled-pyasn1-CVE-2026-30922.patch
+Patch1018:	RHEL-178598-fix-bundled-urllib3-CVE-2026-44431.patch
 
 # AlmaLinux Patch
 Patch2000: 1000-ocf-distro-add-AlmaLinux-to-RHEL-based-distro-detection.patch
@@ -781,6 +782,7 @@ pushd %{buildroot}/usr/lib/%{name}/%{bundled_lib_dir}
 /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1015}
 /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1016}
 /usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=2 < %{PATCH1017}
+/usr/bin/patch --no-backup-if-mismatch -p1 --fuzz=0 < %{PATCH1018}
 popd
 %endif
 
@@ -1075,9 +1077,14 @@ ccs_update_schema > /dev/null 2>&1 ||:
 %{_usr}/lib/ocf/lib/heartbeat/OCF_*.pm
 
 %changelog
-* Tue Jul 14 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.9.0-54.35.alma.1
+* Wed Jul 29 2026 Andrew Lukoshko <alukoshko@almalinux.org> - 4.9.0-54.36.alma.1
 - Add AlmaLinux to RHEL-based distro detection in ocf-distro
 
+* Thu Jul  9 2026 RHEL Packaging Agent <redhat-ymir-agent@redhat.com> - 4.9.0-54.36
+- bundled urllib3: fix CVE-2026-44431
+
+  Resolves: RHEL-178598
+
 * Wed Jun 10 2026 Arslan Ahmad <arahmad@redhat.com> - 4.9.0-54.35
 - nfsserver: stop fsidd when stopping nfsserver