CVE-2026-59939High· 7.5▾ Twilighthttplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 3.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.7%
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
httplib2 < 0.32.0Upgrade past the affected range:
httplib2 0.32.0Affected packages:
httplib2 < 0.32.0Patched in:
httplib2 0.32.0Source: https://osv.dev/vulnerability/GHSA-j5g9-f88f-gfj3
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-103262High· 7.5Tornado versions before 6.5.9 contain an unbounded memory accumulation vulnerability in CurlAsyncHTTPClient that allows remote attackers to cause denial of service by sending a compressed response
CVE-2020-11078Medium· 6.8CRLF injection in httplib2
CVE-2021-21240High· 7.5Regular Expression Denial of Service (REDoS) in httplib2
CVE-2026-49855High· 7.5tornado: Tornado: Denial of Service via uncontrolled gzip decompression memory consumption (CVE-2026-49855)
CVE-2026-44432High· 7.5urllib3 is an HTTP client library for Python
CVE-2026-116177High· 7.5vLLM from 0.10.2 before 0.25.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated attackers to exhau…