TI-2026-42746 CVE-2026-59939 · GHSA-j5g9-f88f-gfj3
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
Priority HIGH 72
httplib2 is a comprehensive HTTP client library for Python.
httplib2
Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical0CVSS 9.0–10.0
CVSS high2CVSS 7.0–8.9
Exploited now
httplib2 records in CISA KEVNo httplib2 vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
4 records
TI-2021-04343 CVE-2021-21240 · GHSA-93xj-8mrv-444m
Regular Expression Denial of Service in httplib2
Priority LOW 39
httplib2 is a comprehensive HTTP client library for Python.
TI-2020-08952 CVE-2020-11078 · GHSA-gg84-qgv9-w4pq
CRLF injection in httplib2
Priority LOW 35
In httplib2 before version 0.18.0, an attacker controlling unescaped part of uri for `httplib2.Http.request()` could change request headers and body, send additional hidden requests to same server.
TI-2013-01808 CVE-2013-2037 · GHSA-q48q-77qv-cf9p
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify…
Priority LOW 16
httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, wh…