Quick answers
- Is CVE-2026-59939 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-59939 being exploited in the wild.
- How severe is CVE-2026-59939?
- High severity, with a CVSS score of 7.5, published 8 July 2026.
- Which products and versions are affected?
- Httplib2 < 0.32.0; httplib2 (PyPI) ECOSYSTEM:introduced=0,fixed=0.32.0.
- Is there a fix for CVE-2026-59939?
- Yes. httplib2 (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-59939 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-59939?
- Check whether you run Httplib2 or httplib2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- httplib2 (PyPI): upgrade to 0.32.0 or later
pip install "httplib2>=0.32.0"
Technical details
The vulnerability exists in the `_decompressContent()` function within `httplib2/__init__.py`. The library uses `gzip.GzipFile().read()` and `zlib.decompress()` without specifying a maximum decompressed size or checking the decompression ratio. An attacker-controlled HTTP server can return a small compressed payload (e.g., ~150 KB) that expands to hundreds of megabytes or gigabytes in memory, leading to a `MemoryError` or an Out-of-Memory (OOM) kill of the client process. This is triggered automatically whenever a response contains the `Content-Encoding: gzip` or `deflate` header. The issue is fixed in version 0.32.0.
Affected products
- httplib2 httplib2 < 0.32.0
Identifiers
- CVE-2026-59939
- GHSA-j5g9-f88f-gfj3
- PYSEC-2026-3444
Timeline
- 2026-06-26: patched: Fix released in version 0.32.0
- 2026-07-08: advisory: NVD publication date
- 2026-07-24: disclosed: GitHub Advisory published