CVE-2026-59939

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

Database specific

{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-409"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/59xxx/CVE-2026-59939.json"
}

References

Affected packages

Git / github.com/httplib2/httplib2

Affected ranges

Type

GIT

Repo

https://github.com/httplib2/httplib2

Events

Introduced

Fixed

ba9bf505cd899f522f2bb58ca608444adf49afc1

Fixed

87581ad6cf752fe3da2090c59058261d2d00a427

Database specific

Show details

{
    "cpe":  "cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:*",
    "extracted_events":  [
        {
            "introduced":  "0"
        },
        {
            "fixed":  "0.32.0"
        }
    ],
    "source":  [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

0.*

0.9

0.9.1

0.9.2

v0.*

v0.10.1

v0.10.3

v0.11.0

v0.11.1

v0.11.2

v0.11.3

v0.12.0

v0.12.3

v0.13.0

v0.13.1

v0.14.0

v0.15.0

v0.16.0

v0.17.0

v0.17.1

v0.17.2

v0.17.3

v0.17.4

v0.18.0

v0.18.1

v0.19.0

v0.19.1

v0.20.0

v0.20.1

v0.20.2

v0.20.3

v0.20.4

v0.21.0

v0.22.0

v0.30.0

v0.30.1

v0.30.2

v0.31.0

v0.31.1

v0.31.2

v0.9

v0.9.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-59939.json"