CVE-2026-59939: httplib2 Unbounded Decompression Denial of Service (CVSS 7.5)

Technical summary

The vulnerability exists in the _decompressContent function within httplib2/init.py. The library fails to validate decompressed content size, permitting zip bombs and deflate bombs—compressed payloads with extreme compression ratios that expand catastrophically when decompressed. An attacker-controlled HTTP server can exploit this by returning a small (kilobyte-range) response with Content-Encoding: gzip or deflate headers that decompresses to gigabytes. The absence of memory limits during decompression leads to MemoryError exceptions or kernel OOM-killer invocation, terminating the client process. This is classified as an Improper Resource Validation vulnerability (CWE-409).

Business impact

Any application using httplib2 to fetch content from untrusted or insufficiently validated HTTP endpoints faces denial-of-service risk. Services that use httplib2 internally—such as monitoring tools, API clients, or data ingestion pipelines—could be silently crashed by a malicious server response. In cloud or containerized environments, repeated OOM crashes may trigger billing spikes or SLA breaches due to pod/instance restarts. Organizations relying on httplib2 for third-party API integrations or web scraping are particularly exposed.

Affected systems

httplib2 versions prior to 0.32.0 are affected. This includes httplib2 0.31.0 and earlier. Check your Python environment with pip show httplib2 or equivalent package manager queries. Applications and microservices that directly import httplib2 or depend on libraries that use httplib2 transitively are in scope. Common use cases include REST API clients, OAuth consumers, and automation scripts.

Exploitability

Exploitability is straightforward and requires no authentication or user interaction. An attacker must either control the HTTP server being accessed or perform network interception (man-in-the-middle). The attack is passive from the client's perspective—simply fetching a crafted response triggers the vulnerability. No special client-side configuration or unusual request patterns are needed. However, real-world impact depends on application architecture; short-lived scripts may tolerate crashes, whereas long-running services suffer availability damage.

Remediation

Upgrade httplib2 to version 0.32.0 or later. For Python environments, run pip install --upgrade httplib2 or update your project's dependency lock file (requirements.txt, poetry.lock, etc.) and redeploy. Verify the upgraded version is in use across all deployment environments and container images. As a temporary mitigation, restrict HTTP requests to trusted servers only, validate server certificates rigorously, and implement network segmentation to reduce MITM risk; however, these do not fix the root cause.

Patch guidance

httplib2 0.32.0 introduces bounds checking for decompressed content, rejecting responses that exceed a reasonable size threshold. Consult the upstream release notes at the httplib2 project repository for specific memory limit values and any configuration options. When upgrading, test affected application components—particularly those that fetch large files or call external APIs—to ensure compatibility. No breaking API changes are documented for the 0.32.0 release.

Detection guidance

Monitor application logs for MemoryError exceptions, OOM-killer events, or unexpected process terminations correlating with HTTP GET/POST operations. Track the httplib2 version in use across your codebase via dependency scanning tools (SBOM, pip-audit, or supply chain tools). Inspect HTTP response headers in network logs for Content-Encoding: gzip or deflate, especially from untrusted origins. Endpoint detection and response (EDR) or application performance monitoring (APM) may surface abnormal memory spikes or sudden memory exhaustion in Python processes. Intrusion detection systems can flag compressed HTTP responses with anomalously low size-to-decompressed-size ratios, though this requires custom tuning.

Why prioritize this

This is a HIGH-severity denial-of-service vulnerability with a CVSS score of 7.5, reflecting high exploitability (network-accessible, no authentication or user interaction required) and significant availability impact (process crash). It is not a data breach vector (no confidentiality or integrity impact), so it falls below critical. However, it directly threatens service availability and is trivial to exploit remotely. Organizations should prioritize remediation alongside other high-severity issues. The absence of KEV (Known Exploited Vulnerabilities) listing does not lower priority; proof-of-concept code could emerge at any time.

Risk score, explained

CVSS 7.5 (HIGH) reflects AV:N (network-accessible attack vector), AC:L (low attack complexity—no special conditions), PR:N (no privileges required), UI:N (no user interaction), and A:H (high availability impact). The vector explicitly shows C:N and I:N, confirming confidentiality and integrity are not compromised. The score is driven entirely by denial-of-service potential. This is a solid B-tier vulnerability—not life-or-death, but material and easily actionable.

Frequently asked questions