# CVE-2026-59939: httplib2 unbounded decompression denial of service

Source: https://junglewise.ai/threats/cve-2026-59939-httplib2-unbounded-decompression-denial-of-service  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-59939 · Severity: high · CVSS 7.5 · Published 2026-07-08

The httplib2 library, a popular tool for making web requests in Python, is vulnerable to a 'decompression bomb' attack. A malicious or compromised website can send a specially crafted, small file that expands to a massive size when opened by the library, consuming all available system memory. This can cause the application using the library to crash or become unresponsive, potentially disrupting business operations or automated services like web crawlers and API clients.

Technologies: [httplib2 (PyPI)](https://junglewise.ai/threats/technologies/pypi-httplib2). Vendors: [PyPI](https://junglewise.ai/threats/vendors/pypi).

## Quick answers

**Is CVE-2026-59939 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-59939 being exploited in the wild.

**How severe is CVE-2026-59939?** High severity, with a CVSS score of 7.5, published 8 July 2026.

**Which products and versions are affected?** Httplib2 < 0.32.0; httplib2 (PyPI) ECOSYSTEM:introduced=0,fixed=0.32.0.

**Is there a fix for CVE-2026-59939?** Yes. httplib2 (PyPI): upgrade to 0.32.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-59939 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-59939?** Check whether you run Httplib2 or httplib2 (PyPI) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- httplib2 (PyPI): upgrade to 0.32.0 or later

  ```sh
  pip install "httplib2>=0.32.0"
  ```


## Technical details

The vulnerability exists in the `_decompressContent()` function within `httplib2/__init__.py`. The library uses `gzip.GzipFile().read()` and `zlib.decompress()` without specifying a maximum decompressed size or checking the decompression ratio. An attacker-controlled HTTP server can return a small compressed payload (e.g., ~150 KB) that expands to hundreds of megabytes or gigabytes in memory, leading to a `MemoryError` or an Out-of-Memory (OOM) kill of the client process. This is triggered automatically whenever a response contains the `Content-Encoding: gzip` or `deflate` header. The issue is fixed in version 0.32.0.

## Affected products

- httplib2 httplib2 < 0.32.0

## Identifiers

- CVE-2026-59939
- GHSA-j5g9-f88f-gfj3
- PYSEC-2026-3444

## Timeline

- 2026-06-26: patched: Fix released in version 0.32.0
- 2026-07-08: advisory: NVD publication date
- 2026-07-24: disclosed: GitHub Advisory published

## References

- [https://api.github.com/users/mauriceng98](https://api.github.com/users/mauriceng98)
- [https://github.com/mauriceng98](https://github.com/mauriceng98)
- [https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D](https://api.github.com/users/mauriceng98/gists%7B/gist_id%7D)
- [https://api.github.com/users/mauriceng98/repos](https://api.github.com/users/mauriceng98/repos)
- [https://avatars.githubusercontent.com/u/97803816?v=4](https://avatars.githubusercontent.com/u/97803816?v=4)
- [https://api.github.com/users/mauriceng98/events%7B/privacy%7D](https://api.github.com/users/mauriceng98/events%7B/privacy%7D)

## Related threats

- [Regular Expression Denial of Service (REDoS) in httplib2](https://junglewise.ai/threats/cve-2021-21240-regular-expression-denial-of-service-redos-in-httplib2)
- [CRLF injection in httplib2](https://junglewise.ai/threats/cve-2020-11078-crlf-injection-in-httplib2)
- [httplib2 incorrectly checks SSL certificate](https://junglewise.ai/threats/cve-2013-2037-httplib2-incorrectly-checks-ssl-certificate)