CVE-2026-59939: httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
(updated )
The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing MemoryError or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.
Any application using httplib2.Http().request() against untrusted or attacker-controlled HTTP endpoints is affected.
References
- github.com/advisories/GHSA-j5g9-f88f-gfj3
- github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427
- github.com/httplib2/httplib2/releases/tag/v0.32.0
- github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3
- github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2026-3444.yaml
- lists.debian.org/debian-lts-announce/2026/08/msg00039.html
- nvd.nist.gov/vuln/detail/CVE-2026-59939
Code Behaviors & Features
Detect and mitigate CVE-2026-59939 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →