{"id":"CVE-2026-59939","title":"httplib2 is a comprehensive HTTP client library for Python","summary":"httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-409"],"vendor":"httplib2_project","product":"httplib2","affected":["httplib2 < 0.32.0"],"patched":["httplib2 0.32.0"],"published":"2026-07-08","updated":"2026-07-13","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59939","references":[{"url":"https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427","label":"security-advisories@github.com"},{"url":"https://github.com/httplib2/httplib2/releases/tag/v0.32.0","label":"security-advisories@github.com"},{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3","label":"security-advisories@github.com"},{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59939"},{"url":"https://github.com/httplib2/httplib2"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2026-3444.yaml"},{"url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00039.html"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59939.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-59939"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2498212"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-59939"},{"url":"https://access.redhat.com/errata/RHSA-2026:49911"},{"url":"https://access.redhat.com/errata/RHSA-2026:48585"},{"url":"https://access.redhat.com/errata/RHSA-2026:47736"},{"url":"https://access.redhat.com/errata/RHSA-2026:48615"},{"url":"https://access.redhat.com/errata/RHSA-2026:48604"},{"url":"https://access.redhat.com/errata/RHSA-2026:48605"},{"url":"https://access.redhat.com/errata/RHSA-2026:50653"},{"url":"https://access.redhat.com/errata/RHSA-2026:50655"},{"url":"https://access.redhat.com/errata/RHSA-2026:50654"},{"url":"https://access.redhat.com/errata/RHSA-2026:50317"},{"url":"https://access.redhat.com/errata/RHSA-2026:50357"},{"url":"https://access.redhat.com/errata/RHSA-2026:50479"},{"url":"https://access.redhat.com/errata/RHSA-2026:50340"},{"url":"https://access.redhat.com/errata/RHSA-2026:43038"},{"url":"https://access.redhat.com/errata/RHSA-2026:84734"}],"tags":["nvd","osv","pip","csaf","vex","red-hat"],"epss":0.00665,"epssPercentile":0.51589,"ingestedAt":"2026-07-13T13:27:18.209Z","aliases":["GHSA-j5g9-f88f-gfj3","PYSEC-2026-3444"],"ecosystem":"pip","slug":"CVE-2026-59939","body":"## Overview\n\nhttplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.\n\n## Affected\n\n- `httplib2 < 0.32.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `httplib2 0.32.0`\n\n## Package advisory (CVE-2026-59939)\n\nAffected packages:\n\n- `httplib2 < 0.32.0`\n\nPatched in:\n\n- `httplib2 0.32.0`\n\nSource: https://osv.dev/vulnerability/GHSA-j5g9-f88f-gfj3\n\n## Vendor advisories\n\n- **RHSA-2026:49911** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v. 10.0) · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:49911)\n- **RHSA-2026:48585** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 10) · released 2026-07-31 · [advisory](https://access.redhat.com/errata/RHSA-2026:48585)\n- **RHSA-2026:47736** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 8), Red Hat Enterprise Linux HighAvailability (v. 8), Red Hat Enterprise Linux ResilientStorage (v. 8) · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:47736)\n- **RHSA-2026:48615** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.4), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4), Red Hat Enterprise Linux High Availability AUS (v.8.4), Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48615)\n- **RHSA-2026:48604** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream AUS (v.8.6), Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6), Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48604)\n- **RHSA-2026:48605** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.8.8), Red Hat Enterprise Linux AppStream TUS (v.8.8), Red Hat Enterprise Linux High Availability E4S (v.8.8), Red Hat Enterprise Linux High Availability TUS (v.8.8) · released 2026-07-30 · [advisory](https://access.redhat.com/errata/RHSA-2026:48605)\n- **RHSA-2026:50653** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.2), Red Hat Enterprise Linux High Availability E4S (v.9.2), Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50653)\n- **RHSA-2026:50655** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream E4S (v.9.4), Red Hat Enterprise Linux High Availability E4S (v.9.4), Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50655)\n- **RHSA-2026:50654** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream EUS (v.9.6) · released 2026-08-05 · [advisory](https://access.redhat.com/errata/RHSA-2026:50654)\n- **RHSA-2026:50317** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9) · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50317)\n- **RHSA-2026:50357** · Red Hat · fixed in: Red Hat Ansible Automation Platform 2.5 · released 2026-08-04 · [advisory](https://access.redhat.com/errata/RHSA-2026:50357)\n- **Red Hat VEX** · Important · affected: Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 7 · no fix planned: Red Hat Enterprise Linux 7, Red Hat Ansible Automation Platform 2 · updated 2026-10-19 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-59939.json)","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}