← Vulnerability feed

Vulnerability record · CVE-2026-59939 · published 8 July 2026

CVE-2026-59939: Httplib2 project httplib2 vulnerability

HHttplib2 Project · Httplib2

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

7.5 CVSS 3.1 High EPSS 0.66% · top 50.2% CWE-409 · CWE-409
7.5CVSS 3.1 base score
0.66%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
5References, 2 tagged exploit
20 Aug 2026Last modified by NVD

Description

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427 Patch
https://github.com/httplib2/httplib2/releases/tag/v0.32.0 Release Notes
https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3 ExploitVendor Advisory
https://lists.debian.org/debian-lts-announce/2026/08/msg00039.html
https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3 ExploitVendor Advisory

Track CVE-2026-59939 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

7.5CVE-2021-21240Httplib2 project httplib2 uncontrolled resource consumption vulnerabilityhttplib2 is a comprehensive HTTP client library for Python. In httplib2 before version 0.19.0, a malicious server which responds with long series of …EPSS 3.6%6.8CVE-2020-11078Httplib2 project httplib2 injection vulnerabilityIn httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body,…EPSS 2.6%2.6CVE-2013-2037Canonical ubuntu linux improper input validation vulnerabilityhttplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject'…EPSS 1.3%

Source: NIST National Vulnerability Database (record CVE-2026-59939), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.