Executive brief
The httplib2 library, a popular tool for making web requests in Python, is vulnerable to a 'decompression bomb' attack. A malicious or compromised website can send a specially crafted, small file that expands to a massive size when opened by the library, consuming all available system memory. This can cause the application using the library to crash or become unresponsive, potentially disrupting business operations or automated services like web crawlers and API clients.
Technical details
The vulnerability exists in the `_decompressContent()` function within `httplib2/__init__.py`. The library uses `gzip.GzipFile().read()` and `zlib.decompress()` without specifying a maximum decompressed size or checking the decompression ratio. An attacker-controlled HTTP server can return a small compressed payload (e.g., ~150 KB) that expands to hundreds of megabytes or gigabytes in memory, leading to a `MemoryError` or an Out-of-Memory (OOM) kill of the client process. This is triggered automatically whenever a response contains the `Content-Encoding: gzip` or `deflate` header. The issue is fixed in version 0.32.0.
Affected products
- httplib2 httplib2 < 0.32.0
Timeline
- 2026-06-26: patched: Fix released in version 0.32.0
- 2026-07-08: advisory: NVD publication date
- 2026-07-24: disclosed: GitHub Advisory published