CVE-2026-59939
published 2026-07-08CVE-2026-59939: httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with…
PriorityP340high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.41%
33.7th percentile
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ansible-automation-platform-24 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-25 | lightspeed-rhel8 | — | — |
| ansible-automation-platform-26 | lightspeed-rhel9 | — | — |
| ansible-automation-platform-27 | lightspeed-rhel9 | — | — |
| fence-agents | fence-agents | — | — |
| httplib2 | httplib2 | < 0.32.0 | 0.32.0 |
| httplib2 | httplib2 | >= 0 < 0.32.0 | 0.32.0 |
| httplib2_project | httplib2 | < 0.32.0 | 0.32.0 |
| mta | mta-solution-server-rhel9 | — | — |
| rhoai | odh-trustyai-garak-lls-provider-dsp-rhel9 | — | — |
| ubuntu | python-httplib2 | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
httplib2 vulnerability
vendor_ubuntu·2026-07-14
CVE-2026-59939 httplib2 vulnerability
Title: httplib2 vulnerability
Summary: httplib2 could be made to crash if it received specially crafted network
traffic.
It was discovered that httplib2 performed unbounded decompression of HTTP
response bodies when the server used gzip or deflate Content-Encoding. A
remote attacker could possibly use this issue to cause httplib2 to use
excessive resources, leading to a denial of service.
Instructions: In general, a standard system update will make all the necessary changes.
Red Hat
httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies
vendor_redhat·2026-07-08·CVSS 7.5
CVE-2026-59939 [HIGH] CWE-409 httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies
httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in m
GHSA
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
ghsa·2026-07-24
CVE-2026-59939 [HIGH] CWE-400 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
### Summary
The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.
Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.
### Details
**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function
The decompression path has two u
VulDB
httplib2 up to 0.31.x Decompression httplib2/init.py _decompressContent encoding error
vuldb·2026-07-08·CVSS 7.5
CVE-2026-59939 [HIGH] httplib2 up to 0.31.x Decompression httplib2/init.py _decompressContent encoding error
A vulnerability has been found in httplib2 up to 0.31.x and classified as problematic. The affected element is the function _decompressContent of the file httplib2/init.py of the component Decompression. The manipulation leads to encoding error.
This vulnerability is traded as CVE-2026-59939. It is possible to initiate the attack remotely. There is no exploit available.
No detection rules found.
No public exploits indexed.
2026-07-08
Published