httplib2 CVE-2026-59939

Exploitation requires that the victim application uses httplib2 (< 0.32.0) to make an HTTP(S) request to a server the attacker controls, has compromised, or can machine-in-the-middle, AND that httplib2 processes a response carrying Content-Encoding: gzip or deflate - which httplib2 decompresses automatically, so no special client configuration is needed. The concrete trigger is a compressed response body whose decompressed size vastly exceeds its wire size (a decompression bomb). Limiting factors: the attacker cannot initiate the request - the client must be induced to fetch attacker-influenced content, so this is server-response/reflected rather than a directly reachable service; impact is confined to availability (crash/OOM of the client process) with no code execution, data disclosure, or integrity impact; and processes protected by strict memory limits will crash and restart a single worker rather than compromise the host.

The supplied CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (base 7.5, HIGH) is internally consistent for a pure availability impact: network attack vector, low complexity, no privileges or user interaction, and no confidentiality or integrity impact (C:N/I:N). This is genuinely an availability-only DoS, not RCE or data exposure - the 7.5 is driven entirely by A:H. A meaningful caveat: exploitation requires the victim to make an HTTP request to a server the attacker controls or has compromised (or can machine-in-the-middle), so 'unauthenticated network' overstates how spontaneously this fires - it is reflected/server-side triggered rather than a listener an attacker reaches directly. The input Tags list 'Information Disclosure,' which conflicts with the CVSS C:N and the description (a memory-exhaustion crash, not disclosure) - that tag appears to be a mislabel and should be disregarded. No EPSS, KEV, or SSVC data was provided; there is no indication of active exploitation. Real-world priority is moderate: raise it for services that fetch attacker-influenced URLs (SSRF-adjacent fetchers, webhooks, crawlers, OAuth/metadata clients), lower it for clients that only talk to trusted first-party endpoints.

An application uses httplib2 to retrieve a URL that an attacker can control or influence (for example a webhook target, a user-supplied avatar/URL fetcher, an OAuth token or metadata endpoint, or via a machine-in-the-middle position). The attacker's server responds with a tiny Content-Encoding: gzip body - a few kilobytes that decompresses to many gigabytes - and httplib2 inflates it fully into memory, driving the worker into MemoryError or an OS OOM-kill. No public exploit code is identified, but the payload is a trivially constructed compression bomb and requires no authentication or user interaction on the victim side.