CVE-2026-59939: httplib2 Python DoS Vulnerability

CVE-2026-59939 Overview

CVE-2026-59939 affects httplib2, a widely used HTTP client library for Python. Versions prior to 0.32.0 perform unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. The flaw resides in the _decompressContent function in httplib2/__init__.py. A malicious or compromised HTTP server can return a small compressed payload that expands to an arbitrarily large size in memory. This triggers a MemoryError or an out-of-memory (OOM) kill of the client process. The issue is classified as an Improper Handling of Highly Compressed Data (Data Amplification) weakness [CWE-409] and is fixed in httplib2 version 0.32.0.

Critical Impact
Any Python application using vulnerable httplib2 versions to fetch data from an attacker-controlled or compromised server can be forced into memory exhaustion, resulting in denial of service.

Affected Products

httplib2 Python library versions prior to 0.32.0
Python applications and services that depend on httplib2 for outbound HTTP requests
Downstream tooling and SDKs bundling vulnerable httplib2 releases

Discovery Timeline

2026-07-08 - CVE-2026-59939 published to NVD
2026-07-08 - Last updated in NVD database

Technical Details for CVE-2026-59939

Vulnerability Analysis

The vulnerability is a classic decompression bomb (zip bomb) pattern applied to HTTP response handling. When httplib2 receives a response with Content-Encoding: gzip or deflate, _decompressContent decompresses the payload into memory without enforcing a maximum output size or compression ratio. Attackers can craft compressed payloads that expand thousands of times their original size. A payload of a few kilobytes can expand to gigabytes in memory. The client process then exhausts available memory and is terminated by the operating system.

Root Cause

The root cause is the absence of bounds checking during streaming decompression in _decompressContent. The function trusts the server-supplied compressed stream and decompresses it fully before returning control. There are no limits on either the total decompressed byte count or the compression ratio between input and output sizes.

Attack Vector

Exploitation requires the victim application to make an HTTP request to a server the attacker controls or has compromised. The attacker returns a valid HTTP response with a Content-Encoding header indicating gzip or deflate and a small, highly compressible body such as a long run of null bytes. When the client processes the response, memory usage grows until the process is killed. No authentication or user interaction on the client side is required beyond initiating the HTTP request.

python

# Patch context from setup.py in the fix commit
    package_data={"httplib2": ["*.txt"]},
    install_requires=read_requirements("requirements.txt"),
    tests_require=read_requirements("requirements-test.txt"),
-    python_requires=">=3.6",
+    python_requires=">=3.8",
    cmdclass={"test": TestCommand},

Source: GitHub Commit 87581ad. The fix bumps the minimum Python version and, per the release notes, introduces size and ratio limits on decompression to prevent unbounded expansion.

Detection Methods for CVE-2026-59939

Indicators of Compromise

Python processes using httplib2 terminating with MemoryError exceptions or OOM-killer log entries in dmesg and /var/log/messages.
HTTP responses received by client applications carrying Content-Encoding: gzip or deflate with abnormally high decompression ratios.
Sudden spikes in resident set size (RSS) for processes making outbound HTTP calls through httplib2.

Detection Strategies

Inventory Python environments and identify installations of httplib2 at versions below 0.32.0 using pip list or Software Bill of Materials (SBOM) tooling.
Inspect application dependency manifests such as requirements.txt, Pipfile.lock, and poetry.lock for pinned vulnerable versions.
Instrument outbound HTTP telemetry to flag responses whose decompressed size exceeds a defined threshold relative to the compressed content length.

Monitoring Recommendations

Monitor per-process memory metrics for Python workloads that perform outbound HTTP requests and alert on anomalous growth.
Correlate kernel OOM-kill events with application logs to identify decompression-triggered crashes.
Track dependency changes in CI/CD pipelines to detect reintroduction of vulnerable httplib2 versions.

How to Mitigate CVE-2026-59939

Immediate Actions Required

Upgrade httplib2 to version 0.32.0 or later across all Python environments, containers, and build artifacts.
Rebuild and redeploy application images that bundle vulnerable versions rather than relying solely on runtime upgrades.
Restrict outbound HTTP requests from sensitive workloads to trusted destinations where feasible until patching completes.

Patch Information

The fix is available in httplib20.32.0. See the GitHub Release v0.32.0, the GitHub Security Advisory GHSA-j5g9-f88f-gfj3, and the patch commit 87581ad. The patch enforces size and ratio limits during decompression and raises the minimum supported Python version to 3.8.

Workarounds

Route outbound HTTP through an egress proxy that strips or validates Content-Encoding headers and enforces maximum response body sizes.
Wrap httplib2 calls with resource limits using resource.setrlimit(RLIMIT_AS, ...) to cap the address space of the client process.
Migrate affected code paths to an alternative HTTP client library that enforces decompression bounds until upgrading is possible.

bash

# Upgrade httplib2 to the fixed version
pip install --upgrade 'httplib2>=0.32.0'

# Verify the installed version
python -c "import httplib2; print(httplib2.__version__)"