{"id":"CVE-2026-59939","title":"httplib2 is a comprehensive HTTP client library for Python","summary":"httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allo…","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-409"],"vendor":"httplib2_project","product":"httplib2","affected":["httplib2 < 0.32.0"],"patched":["httplib2 0.32.0"],"published":"2026-07-08","updated":"2026-07-13","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-59939","references":[{"url":"https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427","label":"security-advisories@github.com"},{"url":"https://github.com/httplib2/httplib2/releases/tag/v0.32.0","label":"security-advisories@github.com"},{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3","label":"security-advisories@github.com"},{"url":"https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59939"},{"url":"https://github.com/httplib2/httplib2"},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2026-3444.yaml"},{"url":"https://lists.debian.org/debian-lts-announce/2026/08/msg00039.html"}],"tags":["nvd","osv","pip"],"epss":0.00423,"epssPercentile":0.3615,"ingestedAt":"2026-07-13T13:27:18.209Z","aliases":["GHSA-j5g9-f88f-gfj3","PYSEC-2026-3444"],"ecosystem":"pip","slug":"CVE-2026-59939","body":"## Overview\n\nhttplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.\n\n## Affected\n\n- `httplib2 < 0.32.0`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `httplib2 0.32.0`\n\n## Package advisory (CVE-2026-59939)\n\nAffected packages:\n\n- `httplib2 < 0.32.0`\n\nPatched in:\n\n- `httplib2 0.32.0`\n\nSource: https://osv.dev/vulnerability/GHSA-j5g9-f88f-gfj3","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}