Memory Overflow Risk in Python httplib2 Package - CVE-2026-59939
Summary
DEBIAN-CVE-2026-59939: httplib2 is a comprehensive HTTP client library for Python. Affects python-httplib2 versions 0.18.1-3 – 0.32.0-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
httplib2 is a comprehensive HTTP client library for Python, widely used for making HTTP requests in a simple and efficient manner. It supports various features such as caching, authentication, and proxy handling. However, prior to version 0.32.0, the library is vulnerable to a memory overflow issue due to unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate.
Vulnerability Detail
The vulnerability arises from the _decompressContent function in httplib2/init.py, where the library does not impose limits on the size of decompressed content. This allows a malicious or compromised HTTP server to send a small compressed payload that expands to an arbitrarily large size in memory, potentially leading to MemoryError or an Out Of Memory (OOM) kill of the client process. This can severely disrupt applications relying on httplib2 for HTTP communication, leading to service outages or degraded performance.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can implement checks on the size of the response body before decompression, ensuring that it does not exceed a predefined limit. This can help mitigate the risk of memory overflow until the package is updated.
Conclusion
The CVE-2026-59939 vulnerability in the Python httplib2 package poses a significant risk due to its potential for memory overflow. Users are encouraged to update to the patched version 0.32.0 or later to mitigate this risk. Additionally, utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for python-httplib2 →
FAQ
CVE-2026-59939 is a vulnerability in the Python httplib2 package that allows for unbounded decompression of HTTP response bodies, potentially leading to memory overflow.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The vulnerability can lead to MemoryError or OOM-kill in the client process, causing service disruptions or degraded performance in applications using httplib2.
Yes, the issue has been fixed in version 0.32.0 of the httplib2 package. Users are advised to upgrade to this version or later.
Vulert is a service that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for python-httplib2.
