CVE catalog
CVE-2026-59939
httplib2 is a comprehensive HTTP client library for…
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
- Severity
- High · CVSS 7.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 0.66% · Oct 27, 2026
Projects and upstream resources
Reported versions and fixes
Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.
Version impact has not been established. The original provider fields are retained below.
Provider details and historical evidence
Original provider fields
{
"package_releases": [
{
"name": "python-httplib2",
"status": "fixed",
"release": "sid",
"version": "0.32.0-1"
},
{
"name": "python-httplib2",
"status": "fixed",
"release": "forky",
"version": "0.32.0-1"
},
{
"name": "python-httplib2",
"status": "fixed",
"release": "trixie",
"version": "0.22.0-1+deb13u1"
},
{
"name": "python-httplib2",
"status": "fixed",
"release": "trixie-security",
"version": "0.22.0-1+deb13u1"
},
{
"name": "python-httplib2",
"status": "vulnerable",
"release": "bookworm",
"version": "0.20.4-3"
},
{
"name": "python-httplib2",
"status": "fixed",
"release": "bookworm-security",
"version": "0.20.4-3+deb12u1"
}
],
"fixed_versions": [
{
"bug": null,
"name": "python-httplib2",
"type": "source",
"origin": null,
"release": "sid",
"urgency": "not yet assigned",
"fixed_version": "0.32.0-1"
},
{
"bug": null,
"name": "python-httplib2",
"type": "source",
"origin": null,
"release": "forky",
"urgency": "not yet assigned",
"fixed_version": "0.32.0-1"
},
{
"bug": null,
"name": "python-httplib2",
"type": "source",
"origin": null,
"release": "trixie",
"urgency": "not yet assigned",
"fixed_version": "0.22.0-1+deb13u1"
},
{
"bug": null,
"name": "python-httplib2",
"type": "source",
"origin": null,
"release": "bookworm",
"urgency": "not yet assigned",
"fixed_version": "0.20.4-3+deb12u1"
}
],
"distribution_packages": [
{
"name": "python-httplib2",
"ecosystem": "cpe",
"fixed_version": "not yet fixed"
},
{
"name": "python-httplib2",
"ecosystem": "cpe",
"fixed_version": "0.20.4-3ubuntu0.1"
},
{
"name": "python3-httplib2",
"ecosystem": "cpe",
"fixed_version": "0.20.4-3ubuntu0.1"
},
{
"name": "httplib2",
"ranges": [
{
"fixed": "0.32.0",
"introduced": "",
"last_affected": "",
"start_excluding": ""
}
],
"ecosystem": "cpe",
"fixed_version": "0.32.0",
"provider_record_id": "NVD-CVE-2026-59939"
},
{
"name": "httplib2",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.32.0"
}
]
}
],
"ecosystem": "PyPI",
"fixed_version": "0.32.0",
"provider_record_id": "GHSA-J5G9-F88F-GFJ3"
},
{
"name": "python-httplib2",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-150400.10.7.1"
}
]
}
],
"release": "linux enterprise module for public cloud 15 sp4",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-150400.10.7.1",
"provider_record_id": "SUSE-SU-2026:3898-1"
},
{
"name": "python-httplib2",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-150400.10.7.1"
}
]
}
],
"release": "linux enterprise module for public cloud 15 sp5",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-150400.10.7.1",
"provider_record_id": "SUSE-SU-2026:3898-1"
},
{
"name": "python-httplib2",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-160000.3.1"
}
]
}
],
"release": "linux enterprise server 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-160000.3.1",
"provider_record_id": "SUSE-SU-2026:23142-1"
},
{
"name": "python-httplib2",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-160000.3.1"
}
]
}
],
"release": "linux enterprise server for sap applications 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-160000.3.1",
"provider_record_id": "SUSE-SU-2026:23142-1"
},
{
"name": "python-httplib2",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-160000.3.1"
}
]
}
],
"release": "linux enterprise server 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-160000.3.1",
"provider_record_id": "SUSE-SU-2026:23120-1"
},
{
"name": "python-httplib2",
"distro": "suse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-160000.3.1"
}
]
}
],
"release": "linux enterprise server for sap applications 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-160000.3.1",
"provider_record_id": "SUSE-SU-2026:23120-1"
},
{
"name": "python-httplib2",
"distro": "opensuse",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-160000.3.1"
}
]
}
],
"release": "leap 16.0",
"versions": [],
"ecosystem": "rpm",
"fixed_version": "0.22.0-160000.3.1",
"provider_record_id": "OPENSUSE-SU-2026:21526-1"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.2-2ubuntu0.1"
}
]
}
],
"release": "22.04",
"versions": [
"0.18.1-3ubuntu1",
"0.20.2-2"
],
"ecosystem": "deb",
"fixed_version": "0.20.2-2ubuntu0.1",
"provider_record_id": "USN-8537-1"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.4-3ubuntu0.1"
}
]
}
],
"release": "24.04",
"versions": [
"0.20.4-3"
],
"ecosystem": "deb",
"fixed_version": "0.20.4-3ubuntu0.1",
"provider_record_id": "USN-8537-1"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-1ubuntu0.1"
}
]
}
],
"release": "26.04",
"versions": [
"0.22.0-1",
"0.22.0-1build1"
],
"ecosystem": "deb",
"fixed_version": "0.22.0-1ubuntu0.1",
"provider_record_id": "USN-8537-1"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "14.04",
"versions": [
"0.8-2",
"0.8-2build1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "16.04",
"versions": [
"0.9+dfsg-2",
"0.9.1+dfsg-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "18.04",
"versions": [
"0.9.2+dfsg-1",
"0.9.2+dfsg-1ubuntu0.1",
"0.9.2+dfsg-1ubuntu0.2",
"0.9.2+dfsg-1ubuntu0.3"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "20.04",
"versions": [
"0.11.3-2",
"0.11.3-2build1",
"0.14.0-1",
"0.14.0-1ubuntu1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.2-2ubuntu0.1"
}
]
}
],
"release": "22.04",
"versions": [
"0.18.1-3ubuntu1",
"0.20.2-2"
],
"ecosystem": "deb",
"fixed_version": "0.20.2-2ubuntu0.1",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.20.4-3ubuntu0.1"
}
]
}
],
"release": "24.04",
"versions": [
"0.20.4-3"
],
"ecosystem": "deb",
"fixed_version": "0.20.4-3ubuntu0.1",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"release": "25.10",
"versions": [
"0.22.0-1"
],
"ecosystem": "deb",
"fixed_version": "",
"provider_record_id": "UBUNTU-CVE-2026-59939"
},
{
"name": "python-httplib2",
"distro": "ubuntu",
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "0.22.0-1ubuntu0.1"
}
]
}
],
"release": "26.04",
"versions": [
"0.22.0-1",
"0.22.0-1build1"
],
"ecosystem": "deb",
"fixed_version": "0.22.0-1ubuntu0.1",
"provider_record_id": "UBUNTU-CVE-2026-59939"
}
]
}OpenFactory catalog packages
Matching against OpenFactory catalog package versions is in progress.
[Debian 12 (Bookworm)]
- [python3-httplib2]Unknown
Source package: [python-httplib2]
Details (4)
0.20.4-3· all · bookwormAffected · Fixed:
0.20.4-3+deb12u1nvd · python-httplib2 · debian · bookworm; nvd · python-httplib2 · debian · 12
0.20.4-3· all · bookwormAffected · Fixed:
0.20.4-3+deb12u1nvd · python-httplib2 · debian · bookworm; nvd · python-httplib2 · debian · 12
0.20.4-3+deb12u1· all · bookworm-securityFixed · Fixed:
0.20.4-3+deb12u1nvd · python-httplib2 · debian · bookworm; nvd · python-httplib2 · debian · 12
0.20.4-3+deb12u1· all · bookworm-securityFixed · Fixed:
0.20.4-3+deb12u1nvd · python-httplib2 · debian · bookworm; nvd · python-httplib2 · debian · 12
[Debian 13 (Trixie)]
- [python3-httplib2]Unknown
Source package: [python-httplib2]
Details (4)
0.22.0-1· all · trixieAffected · Fixed:
0.22.0-1+deb13u1nvd · python-httplib2 · debian · 13
0.22.0-1· all · trixieAffected · Fixed:
0.22.0-1+deb13u1nvd · python-httplib2 · debian · 13
0.22.0-1+deb13u1· all · trixie-securityFixed · Fixed:
0.22.0-1+deb13u1nvd · python-httplib2 · debian · 13
0.22.0-1+deb13u1· all · trixie-securityFixed · Fixed:
0.22.0-1+deb13u1nvd · python-httplib2 · debian · 13
Observed:
References
- [https://access.redhat.com/errata/RHSA-2026:50357]
- [https://ftp.suse.com/pub/projects/security/csaf/rhsa-2026_47736.json]
- [https://nvd.nist.gov/vuln/detail/CVE-2026-59939]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2026-59939]
- [https://osv.dev/vulnerability/GHSA-j5g9-f88f-gfj3]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23120-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:23142-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3898-1]
- [https://osv.dev/vulnerability/UBUNTU-CVE-2026-59939]
- [https://osv.dev/vulnerability/USN-8537-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:21526-1]
- [https://security-tracker.debian.org/tracker/CVE-2026-59939]
- [https://ubuntu.com/security/notices/USN-8537-1]
- [https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-2588.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]