CVE-2026-59939

Name
CVE-2026-59939
Description
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
NVD Severity
unknown
Other trackers
CVE, NVD, CERT, CVE Details, CIRCL, Arch Linux, Debian, Red Hat, Ubuntu, Gentoo, SUSE (Bugzilla), SUSE (CVE), Mageia
Mailing lists
oss-security, full-disclosure, bugtraq
Exploits
Exploit DB, Metasploit
Forges
GitHub (code, issues), Aports (code, issues)

References

Type URI
security-advisories@github.com https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
security-advisories@github.com https://github.com/httplib2/httplib2/releases/tag/v0.32.0
security-advisories@github.com https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3

Match rules

CPE URI Source package Min version Max version
cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:* py3-httplib2 >= None < 0.32.0

Vulnerable and fixed packages

Source package Branch Version Maintainer Status
py3-httplib2 edge-community 0.30.0-r1 Fabian Affolter <fabian@affolter-engineering.ch> possibly vulnerable
py3-httplib2 edge-community 0.30.0-r0 Fabian Affolter <fabian@affolter-engineering.ch> possibly vulnerable
py3-httplib2 edge-community 0.22.0-r2 Fabian Affolter <fabian@affolter-engineering.ch> possibly vulnerable
py3-httplib2 edge-community 0.19.0-r0 None possibly vulnerable
py3-httplib2 3.24-community 0.30.0-r1 Fabian Affolter <fabian@affolter-engineering.ch> possibly vulnerable