Description
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Published: 2026-07-08
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

httplib2's _decompressContent unboundedly decompresses compressed HTTP responses, allowing an attacker to send a small compressed payload that expands to an arbitrarily large size, resulting in a MemoryError or OS out‑of‑memory kill. The flaw is a classic resource exhaustion vulnerability (CWE-409).

Affected Systems

Any Python application using httplib2 version 0.31.0 or earlier, such as web crawlers, REST clients, automated testing tools or any code that imports httplib2. The vulnerability is fixed in version 0.32.0 and later.

Risk and Exploitability

The CVSS score of 7.5 classifies this as a high severity vulnerability, while the EPSS score of <1% indicates a very low likelihood of exploitation at the time of analysis. It is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector is remote: an attacker can send a specifically crafted compressed HTTP response to any httplib2 client over the network. The exploit requires no authentication or privileged state, making it broadly feasible for unauthenticated attackers.

Generated by OpenCVE AI on July 29, 2026 at 13:41 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade the httplib2 library to version 0.32.0 or newer, which limits decompression size and includes the fix.
  • If an upgrade cannot be performed immediately, intercept the HTTP response before it is decompressed and enforce a hard cap on the maximum number of decompressed bytes the client will process; discard or terminate the request if the cap is exceeded.
  • Implement overall application memory usage monitoring and set resource limits (e.g., OS cgroups or container memory limits) to isolate the httplib2 process so that a memory‑exhaustion attack cannot bring down the entire system.

Generated by OpenCVE AI on July 29, 2026 at 13:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Github GHSA Github GHSA GHSA-j5g9-f88f-gfj3 httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Ubuntu USN Ubuntu USN USN-8537-1 httplib2 vulnerability
History

Fri, 10 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 09:30:00 +0000

Type Values Removed Values Added
First Time appeared Httplib2 Project
Httplib2 Project httplib2
Vendors & Products Httplib2 Project
Httplib2 Project httplib2

Fri, 10 Jul 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 threat_severity

Important

Wed, 08 Jul 2026 19:45:00 +0000

Type Values Removed Values Added
Description httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Title httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Weaknesses CWE-409
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

Httplib2 Project Httplib2
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-10T14:55:12.554Z

Reserved: 2026-07-07T18:20:06.127Z

Link: CVE-2026-59939

cve-icon Vulnrichment

Updated: 2026-07-10T14:54:22.170Z

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-08T19:34:05Z

Links: CVE-2026-59939 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-26T17:30:17Z

Weaknesses
  • CWE-409

    Improper Handling of Highly Compressed Data (Data Amplification)