CVE-2026-59939

HIGH 7.5

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

CVSS Score

7.5

EPSS Score

0.4%

EPSS Percentile

34th

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

CWE	CWE-409
Vendor	httplib2
Product	httplib2
Published	Jul 8, 2026
Last Updated	Aug 20, 2026

Stay Ahead of the Next One

Get instant alerts for httplib2 httplib2

Be the first to know when new high vulnerabilities affecting httplib2 httplib2 are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Affected Versions

httplib2 / httplib2

< 0.32.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

github.com: https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3 github.com: https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427 github.com: https://github.com/httplib2/httplib2/releases/tag/v0.32.0 lists.debian.org: https://lists.debian.org/debian-lts-announce/2026/08/msg00039.html