CVE-2026-59939
High
Description
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
SeverityHigh
CVSS7.5
Exploit probability—
ProductHttplib2
PublishedJul 8, 2026
First seenJul 8, 2026
Weakness typeCWE-409CWE-409
How to fix
Update
- httplib2_project httplib20.32.0 or later
- httplib20.32.0 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| httplib2_project httplib2 | v < 0.32.0 | 0.32.0 |
| httplib2PyPI | v < 0.32.0 | 0.32.0 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.