High severity7.5NVD Advisory· Published Jul 8, 2026· Updated Aug 20, 2026
CVE-2026-59939
CVE-2026-59939
Description
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
96cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:*+ 1 more
- cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:*range: <0.32.0
- (no CPE)range: <0.32.0
- osv-coords94 versionspkg:apk/chainguard/apache-beam-python-3.11-sdkpkg:apk/chainguard/apache-beam-python-3.12-sdkpkg:apk/chainguard/apache-beam-python-3.13-sdkpkg:apk/chainguard/authentik-2026.2pkg:apk/chainguard/authentik-2026.5pkg:apk/chainguard/authentik-fips-2026.2pkg:apk/chainguard/authentik-fips-2026.5pkg:apk/chainguard/duplicitypkg:apk/chainguard/kubeflow-pipelines-visualization-serverpkg:apk/chainguard/openstack-glance-2025.1pkg:apk/chainguard/openstack-glance-2025.1-fipspkg:apk/chainguard/openstack-glance-2025.2pkg:apk/chainguard/openstack-glance-2025.2-fipspkg:apk/chainguard/openstack-glance-2026.1pkg:apk/chainguard/openstack-glance-2026.1-fipspkg:apk/chainguard/openstack-horizon-2025.1pkg:apk/chainguard/openstack-horizon-2025.1-fipspkg:apk/chainguard/openstack-horizon-2025.2pkg:apk/chainguard/openstack-horizon-2025.2-fipspkg:apk/chainguard/openstack-horizon-2026.1pkg:apk/chainguard/openstack-horizon-2026.1-fipspkg:apk/chainguard/openstack-keystone-2025.1pkg:apk/chainguard/openstack-keystone-2025.1-fipspkg:apk/chainguard/openstack-keystone-2025.2pkg:apk/chainguard/openstack-keystone-2025.2-fipspkg:apk/chainguard/openstack-keystone-2026.1pkg:apk/chainguard/openstack-keystone-2026.1-fipspkg:apk/chainguard/openstack-nova-2025.1pkg:apk/chainguard/openstack-nova-2025.2pkg:apk/chainguard/openstack-nova-2026.1pkg:apk/chainguard/openstack-placement-2025.1pkg:apk/chainguard/openstack-placement-2025.1-fipspkg:apk/chainguard/openstack-placement-2025.2pkg:apk/chainguard/openstack-placement-2025.2-fipspkg:apk/chainguard/openstack-placement-2026.1pkg:apk/chainguard/openstack-placement-2026.1-fipspkg:apk/wolfi/kubeflow-pipelines-visualization-serverpkg:rpm/almalinux/fence-agents-aliyunpkg:rpm/almalinux/fence-agents-allpkg:rpm/almalinux/fence-agents-amt-wspkg:rpm/almalinux/fence-agents-apcpkg:rpm/almalinux/fence-agents-apc-snmppkg:rpm/almalinux/fence-agents-awspkg:rpm/almalinux/fence-agents-azure-armpkg:rpm/almalinux/fence-agents-bladecenterpkg:rpm/almalinux/fence-agents-brocadepkg:rpm/almalinux/fence-agents-cisco-mdspkg:rpm/almalinux/fence-agents-cisco-ucspkg:rpm/almalinux/fence-agents-commonpkg:rpm/almalinux/fence-agents-computepkg:rpm/almalinux/fence-agents-drac5pkg:rpm/almalinux/fence-agents-eaton-snmppkg:rpm/almalinux/fence-agents-emersonpkg:rpm/almalinux/fence-agents-epspkg:rpm/almalinux/fence-agents-gcepkg:rpm/almalinux/fence-agents-heuristics-pingpkg:rpm/almalinux/fence-agents-hpbladepkg:rpm/almalinux/fence-agents-ibm-powervspkg:rpm/almalinux/fence-agents-ibm-vpcpkg:rpm/almalinux/fence-agents-ibmbladepkg:rpm/almalinux/fence-agents-ifmibpkg:rpm/almalinux/fence-agents-ilo-moonshotpkg:rpm/almalinux/fence-agents-ilo-mppkg:rpm/almalinux/fence-agents-ilo-sshpkg:rpm/almalinux/fence-agents-ilo2pkg:rpm/almalinux/fence-agents-intelmodularpkg:rpm/almalinux/fence-agents-ipdupkg:rpm/almalinux/fence-agents-ipmilanpkg:rpm/almalinux/fence-agents-kdumppkg:rpm/almalinux/fence-agents-kubevirtpkg:rpm/almalinux/fence-agents-lparpkg:rpm/almalinux/fence-agents-mpathpkg:rpm/almalinux/fence-agents-nutanix-ahvpkg:rpm/almalinux/fence-agents-openstackpkg:rpm/almalinux/fence-agents-redfishpkg:rpm/almalinux/fence-agents-rhevmpkg:rpm/almalinux/fence-agents-rsapkg:rpm/almalinux/fence-agents-rsbpkg:rpm/almalinux/fence-agents-sbdpkg:rpm/almalinux/fence-agents-scsipkg:rpm/almalinux/fence-agents-virshpkg:rpm/almalinux/fence-agents-vmware-restpkg:rpm/almalinux/fence-agents-vmware-soappkg:rpm/almalinux/fence-agents-wtipkg:rpm/almalinux/fence-agents-zvmpkg:rpm/almalinux/fence-virtpkg:rpm/almalinux/fence-virtdpkg:rpm/almalinux/fence-virtd-cpgpkg:rpm/almalinux/fence-virtd-libvirtpkg:rpm/almalinux/fence-virtd-multicastpkg:rpm/almalinux/fence-virtd-serialpkg:rpm/almalinux/fence-virtd-tcppkg:rpm/almalinux/ha-cloud-supportpkg:rpm/opensuse/python-httplib2&distro=openSUSE%20Leap%2016.0
< 2.75.0-r2+ 93 more
- (no CPE)range: < 2.75.0-r2
- (no CPE)range: < 2.75.0-r1
- (no CPE)range: < 2.75.0-r2
- (no CPE)range: < 2026.2.6-r10
- (no CPE)range: < 2026.5.6-r2
- (no CPE)range: < 2026.2.6-r6
- (no CPE)range: < 2026.5.6-r3
- (no CPE)range: < 3.1.0-r2
- (no CPE)range: < 2.17.0-r2
- (no CPE)range: < 30.2.0_git20260616-r7
- (no CPE)range: < 30.2.0_git20260617-r7
- (no CPE)range: < 31.1.0_git20260708-r1
- (no CPE)range: < 31.1.0_git20260803-r1
- (no CPE)range: < 32.0.0_git20260723-r1
- (no CPE)range: < 32.0.0_git20260724-r1
- (no CPE)range: < 25.3.2_git20260617-r5
- (no CPE)range: < 25.3.2_git20260617-r5
- (no CPE)range: < 25.5.2_git20260617-r5
- (no CPE)range: < 25.5.2_git20260617-r6
- (no CPE)range: < 25.7.3_git20260630-r3
- (no CPE)range: < 25.7.3_git20260630-r3
- (no CPE)range: < 27.0.1_git20260618-r7
- (no CPE)range: < 27.0.1_git20260618-r9
- (no CPE)range: < 28.0.1_git20260618-r7
- (no CPE)range: < 28.0.1_git20260618-r7
- (no CPE)range: < 29.0.1_git20260616-r7
- (no CPE)range: < 29.0.1_git20260617-r8
- (no CPE)range: < 31.3.0_git20260717-r1
- (no CPE)range: < 32.2.0_git20260715-r1
- (no CPE)range: < 33.0.1_git20260727-r0
- (no CPE)range: < 13.0.0_git20260720-r1
- (no CPE)range: < 13.0.0_git20260720-r1
- (no CPE)range: < 14.0.0_git20260617-r8
- (no CPE)range: < 14.0.0_git20260309-r8
- (no CPE)range: < 15.0.0_git20260617-r8
- (no CPE)range: < 15.0.0_git20260617-r7
- (no CPE)range: < 2.17.0-r2
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.2.1-129.el8_10.27
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 4.16.0-21.el10_2.5
- (no CPE)range: < 0.22.0-160000.3.1
Patches
Vulnerability mechanics
References
7- github.com/httplib2/httplib2/commit/87581ad6cf752fe3da2090c59058261d2d00a427nvdPatch
- github.com/httplib2/httplib2/security/advisories/GHSA-j5g9-f88f-gfj3nvdExploitVendor Advisory
- github.com/advisories/GHSA-j5g9-f88f-gfj3ghsaADVISORY
- github.com/httplib2/httplib2/releases/tag/v0.32.0nvdRelease Notes
- github.com/pypa/advisory-database/tree/main/vulns/httplib2/PYSEC-2026-3444.yamlghsa
- lists.debian.org/debian-lts-announce/2026/08/msg00039.htmlnvd
- nvd.nist.gov/vuln/detail/CVE-2026-59939ghsa
News mentions
0No linked articles in our index yet.