CVE-2026-59939

Name of the Vulnerable Software and Affected Versions httplib2 versions prior to 0.32.0

Description An issue exists where the library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate within the decompressContent() function in httplib2/init.py. A malicious or compromised HTTP server can return a small compressed payload, known as a decompression bomb, that expands to an arbitrarily large size in memory. This uncontrolled resource consumption can lead to a MemoryError or cause the client process to be OOM-killed (Out-Of-Memory killed), resulting in a denial-of-service.

Recommendations Update to version 0.32.0.