Vulnerability Details CVE-2026-59939
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 25.9%
CVSS Severity
CVSS v3 Score 7.5
References
Products affected by CVE-2026-59939
-
cpe:2.3:a:httplib2_project:httplib2:0.10.1
-
cpe:2.3:a:httplib2_project:httplib2:0.10.2
-
cpe:2.3:a:httplib2_project:httplib2:0.10.3
-
cpe:2.3:a:httplib2_project:httplib2:0.11.0
-
cpe:2.3:a:httplib2_project:httplib2:0.11.1
-
cpe:2.3:a:httplib2_project:httplib2:0.11.2
-
cpe:2.3:a:httplib2_project:httplib2:0.11.3
-
cpe:2.3:a:httplib2_project:httplib2:0.12.0
-
cpe:2.3:a:httplib2_project:httplib2:0.12.1
-
cpe:2.3:a:httplib2_project:httplib2:0.12.3
-
cpe:2.3:a:httplib2_project:httplib2:0.13.0
-
cpe:2.3:a:httplib2_project:httplib2:0.13.1
-
cpe:2.3:a:httplib2_project:httplib2:0.14.0
-
cpe:2.3:a:httplib2_project:httplib2:0.15.0
-
cpe:2.3:a:httplib2_project:httplib2:0.16.0
-
cpe:2.3:a:httplib2_project:httplib2:0.17.0
-
cpe:2.3:a:httplib2_project:httplib2:0.17.1
-
cpe:2.3:a:httplib2_project:httplib2:0.17.2
-
cpe:2.3:a:httplib2_project:httplib2:0.17.3
-
cpe:2.3:a:httplib2_project:httplib2:0.17.4
-
cpe:2.3:a:httplib2_project:httplib2:0.18.0
-
cpe:2.3:a:httplib2_project:httplib2:0.18.1
-
cpe:2.3:a:httplib2_project:httplib2:0.19.0
-
cpe:2.3:a:httplib2_project:httplib2:0.9
-
cpe:2.3:a:httplib2_project:httplib2:0.9.1
-
cpe:2.3:a:httplib2_project:httplib2:0.9.2