CVE-2026-59939High· 7.5▾ Twilighthttplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allo…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 13.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.3%
0.3% → 0.4%
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
httplib2 < 0.32.0Upgrade past the affected range:
httplib2 0.32.0Affected packages:
httplib2 < 0.32.0Patched in:
httplib2 0.32.0Connected by shared product, vendor, weakness, or advisory.
CVE-2020-11078Medium· 6.8CRLF injection in httplib2
CVE-2021-21240High· 7.5Regular Expression Denial of Service (REDoS) in httplib2
CVE-2026-84382High· 7.5HTTPX2 is a next generation HTTP client for Python
CVE-2026-8814Medium· 5.3Versions of the package exifreader before 4.39.0 are vulnerable to Improper Handling of Highly Compressed Data (Data Amplification) due to decompressing PNG zTXt metadata without enforcing a built-in maximum decompressed output size
CVE-2026-59200High· 7.5Pillow: Pillow: Denial of service via crafted PDF stream (CVE-2026-59200)
CVE-2026-54278Mediumaiohttp: Unread Compressed Request Bodies Bypass client_max_size During Cleanup