7.5 CVE-2026-59939
Enriched by CISA Patch Exploit
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
https://nvd.nist.gov/vuln/detail/CVE-2026-59939
Categories
CWE-409 : Improper Handling of Highly Compressed Data (Data Amplification)
An example of data amplification is a "decompression bomb," a small ZIP file that can produce a large amount of data when it is decompressed.
References
134c704f-9b21-4f2e-91b3-4a467353bcc0 Exploit
security-advisories@github.com Patch Exploit
AFFECTED (from MITRE)
| Vendor |
Product |
Versions |
| httplib2 |
httplib2 |
|
| © 2022 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. |
CPE
| cpe |
start |
end |
| Configuration 1 |
| cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:* |
|
< 0.32.0 |
REMEDIATION
Patch
EXPLOITS
Exploit-db.com
| id |
description |
date |
|
| No known exploits |
POC Github
Other Nist (github, ...)
CAPEC
Common Attack Pattern Enumerations and Classifications
| id |
description |
severity |
| No entry |
Cybersecurity needs ?
Strengthen software security from the outset with our DevSecOps expertise
Integrate security right from the start of the software development cycle for more robust applications and greater customer confidence.
Our team of DevSecOps experts can help you secure your APIs, data pipelines, CI/CD chains, Docker containers and Kubernetes deployments.
Discover this offer
