Skip to main content

httplib2 CVE-2026-59939

| EUVDEUVD-2026-42364 HIGH
Improper Handling of Highly Compressed Data (Data Amplification) (CWE-409)
2026-07-08 GitHub_M GHSA-j5g9-f88f-gfj3 PYSEC-2026-3444
Python Information Disclosure Httplib2
7.5
CVSS 3.1 · Vendor: GitHub_M
Share

Severity by source

Vendor (GitHub_M) PRIMARY
7.5 HIGH
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
7.5 HIGH

Network-delivered via a malicious server response with no auth or interaction on the client, availability-only memory-exhaustion impact, so A:H with C:N/I:N; scope unchanged as only the client process is affected.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.5 HIGH
qualitative

Primary rating from Vendor (GitHub_M).

CVSS VectorVendor: GitHub_M

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

2
Patch available
Jul 08, 2026 - 21:04 EUVD
Analysis Generated
Jul 08, 2026 - 20:25 vuln.today

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 5,313 pypi packages depend on httplib2 (332 direct, 5,007 indirect)

Ecosystem-wide dependent count for version 0.32.0.

DescriptionCVE.org

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

Articles & Coverage 1

News 10 New Python Vulnerabilities - 2 Critical, 8 High, 1 With POC Jul 09, 2026

AnalysisAI

Denial of service in the httplib2 Python HTTP client library (all versions prior to 0.32.0) lets a malicious or compromised HTTP server crash the client by returning a small gzip- or deflate-compressed response body that expands without bound during automatic decompression, exhausting memory and triggering a MemoryError or OS OOM-kill. Any application that uses httplib2 to fetch content from untrusted or attacker-controllable endpoints is affected. No public exploit identified at time of analysis; EPSS not provided, but the class is trivially demonstrable and the fix is a one-line-scope behavioral change shipped in 0.32.0.

Technical ContextAI

httplib2 is a widely-used, dependency-light Python HTTP client that transparently handles Content-Encoding. The flaw lives in _decompressContent in httplib2/__init__.py, which decompresses gzip/deflate response bodies in a single unbounded pass with no cap on the decompressed size relative to the compressed input. This is CWE-409 (Improper Handling of Highly Compressed Data / data amplification), the classic 'decompression bomb' / 'zip bomb' pattern: compression ratios for gzip/deflate can exceed 1000:1, so a few kilobytes on the wire can inflate to gigabytes in the client's address space. The root cause is that the client trusts the server's advertised encoding and decompresses eagerly into memory rather than streaming with a size limit.

RemediationAI

Upgrade httplib2 to Vendor-released patch: 0.32.0 (https://github.com/httplib2/httplib2/releases/tag/v0.32.0), which bounds decompression of gzip/deflate response bodies; pin the dependency and rebuild any lockfiles / transitive requirements since httplib2 is frequently pulled in indirectly (e.g. by google-api-python-client and oauth2client). Details are in advisory GHSA-j5g9-f88f-gfj3 and commit 87581ad6cf752fe3da2090c59058261d2d00a427. If you cannot upgrade immediately, restrict the client to trusted first-party endpoints and avoid using httplib2 to fetch attacker-controllable URLs; where feasible, front outbound fetches with a proxy or wrapper that enforces a maximum response size and rejects or truncates oversized bodies, and run the process under a memory cgroup/ulimit so an OOM event kills and restarts a single worker rather than destabilizing the host - noting the trade-off that a hard memory cap or size limit can break legitimately large downloads. Disabling gzip/deflate by not advertising Accept-Encoding reduces the amplification surface but does not fully close it if a server sends compressed content regardless, and costs bandwidth.

More in Python

View all
CVE-2025-24016 CRITICAL POC
9.9 Feb 10

Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI t
CVE-2025-27520 CRITICAL POC
9.8 Apr 04

BentoML version 1.4.2 and earlier contains an unauthenticated remote code execution vulnerability through insecure deser
CVE-2025-2945 CRITICAL POC
9.9 Apr 03

pgAdmin 4 contains critical remote code execution vulnerabilities in the Query Tool download and Cloud Deployment endpoi
CVE-2013-5093 MEDIUM POC
6.8 Sep 27

The renderLocalView function in render/views.py in graphite-web in Graphite 0.9.5 through 0.9.10 uses the pickle Python

CVE-2025-32375 CRITICAL POC
9.8 Apr 09

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Rated critica
CVE-2014-0224 HIGH POC
7.4 Jun 05

OpenSSL before 0.9.8za, 1.0.0 before 1.0.0m, and 1.0.1 before 1.0.1h does not properly restrict processing of ChangeCiph
CVE-2024-21644 HIGH POC
7.5 Jan 08

pyLoad download manager version prior to 0.5.0b3.dev77 exposes the Flask SECRET_KEY through an unauthenticated endpoint.
CVE-2026-33017 CRITICAL POC
9.3 Mar 17

Langflow (a visual LLM pipeline builder) contains a critical unauthenticated code execution vulnerability (CVE-2026-3301
CVE-2017-9462 HIGH POC
8.8 Jun 06

In Mercurial before 4.1.3, "hg serve --stdio" allows remote authenticated users to launch the Python debugger, and conse
CVE-2026-39987 CRITICAL POC
9.3 Apr 08

Unauthenticated remote code execution in Marimo ≤0.20.4 allows attackers to execute arbitrary system commands via the `/
CVE-2024-21645 MEDIUM POC
5.3 Jan 08

pyLoad is the free and open-source Download Manager written in pure Python. Rated medium severity (CVSS 5.3), this vulne
CVE-2026-55255 HIGH POC
8.4 Jun 19

Cross-user flow execution in Langflow (< 1.9.1) lets any authenticated API-key holder run another user's flow by passing

Same weakness CWE-409 – Improper Handling of Highly Compressed Data (Data Amplification)

View all
CVE-2026-59803 HIGH POC
8.7
CVE-2026-49755 HIGH POC
8.2
CVE-2026-48594 HIGH POC
8.2
CVE-2024-7765 HIGH POC
7.5
CVE-2026-22776 HIGH POC
7.5
CVE-2026-22870 HIGH POC
7.5
CVE-2024-3572 HIGH POC
7.5
CVE-2025-58057 MEDIUM POC
6.9

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 12 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Basesystem 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-59939 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy