Copyright © 2012 Red Hat, Inc. All rights reserved. Important 2026-07-08T19:34:05 httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CWE-409

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

A flaw was found in httplib2, a Python HTTP client library. This vulnerability allows a malicious or compromised HTTP server to send a small compressed data payload that, when decompressed by httplib2, expands to an extremely large size in memory. This unbounded decompression can lead to a Denial of Service (DoS) by causing the client application to run out of memory and crash.

This Important vulnerability in `httplib2` allows a remote attacker to trigger a Denial of Service (DoS) in client applications. By sending a specially crafted, compressed HTTP response, a malicious server can cause the client to exhaust its memory due to unbounded decompression, leading to application crashes. This poses a significant risk to Red Hat products that use `httplib2` to process untrusted HTTP content. Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. Migration Toolkit for Applications 8 Affected mta/mta-solution-server-rhel9 Red Hat Ansible Automation Platform 2 Will not fix ansible-automation-platform-24/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-25/lightspeed-rhel8 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-26/lightspeed-rhel9 Red Hat Ansible Automation Platform 2 Affected ansible-automation-platform-27/lightspeed-rhel9 Red Hat Enterprise Linux 10 Affected fence-agents Red Hat Enterprise Linux 7 Out of support scope fence-agents Red Hat Enterprise Linux 8 Affected fence-agents Red Hat Enterprise Linux 9 Affected fence-agents Red Hat Hardened Images Not affected mariadb11.8 Red Hat OpenShift AI (RHOAI) Affected rhoai/odh-trustyai-garak-lls-provider-dsp-rhel9 https://www.cve.org/CVERecord?id=CVE-2026-59939 https://nvd.nist.gov/vuln/detail/CVE-2026-59939 https://github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427 https://github.com/httplib2/httplib2/releases/tag/v0.32.0 https://github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3