Read the docs
TI-2026-42746 Aliases CVE-2026-59939GHSA-j5g9-f88f-gfj3

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Priority HIGH 72CWE-409Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 29 fixed, 2 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00665 52nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial httplib2 (httplib2): 0.32.0httplib2 (PyPI): 0.32.0Red Hat: 15 advisoriesRed Hat: 29 fixed, 2 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
httplib2httplib2before 0.32.00.32.0Patch availableCNA
—httplib2 (PyPI)before 0.32.00.32.0Patch availableGHSA-j5g9-f88f-gfj3
  • httplib2 Vendorhttplib2 Affected before 0.32.0 Fixed in 0.32.0 Patch available CNA
  • httplib2 (PyPI) Vendor— Affected before 0.32.0 Fixed in 0.32.0 Patch available GHSA-j5g9-f88f-gfj3

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:*before 0.32.0Vulnerablehttplib2
  • cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:* Versions before 0.32.0 Vulnerable ·httplib2

Remediation

  • Fix · CNA httplib2 (httplib2) Fixed in 0.32.0
  • Fix · GHSA-j5g9-f88f-gfj3 httplib2 (PyPI) Fixed in 0.32.0 Advisory →

Red Hat 15 advisories

  • RHSA-2026:84734 Released 2026-10-19 · Red Hat rating Critical
    RHOAI 3.4.5 - Red Hat OpenShift AI
    • Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
  • RHSA-2026:50655 Released 2026-08-05 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.4) fence-agents-4.10.0-62.el9_4.27, fence-agents-common-4.10.0-62.el9_4.27, fence-agents-compute-4.10.0-62.el9_4.27 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.27, fence-agents-all-4.10.0-62.el9_4.27, fence-agents-amt-ws-4.10.0-62.el9_4.27 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.4) fence-agents-aliyun-4.10.0-62.el9_4.27, fence-agents-all-4.10.0-62.el9_4.27, fence-agents-amt-ws-4.10.0-62.el9_4.27 +39
  • RHSA-2026:50654 Released 2026-08-05 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v.9.6) fence-agents-4.10.0-86.el9_6.19, fence-agents-aliyun-4.10.0-86.el9_6.19, fence-agents-all-4.10.0-86.el9_6.19 +47
Show 12 more Red Hat advisories
  • RHSA-2026:50653 Released 2026-08-05 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.9.2) fence-agents-4.10.0-43.el9_2.24, fence-agents-common-4.10.0-43.el9_2.24, fence-agents-compute-4.10.0-43.el9_2.24 +11
    • Red Hat Enterprise Linux High Availability E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.24, fence-agents-all-4.10.0-43.el9_2.24, fence-agents-amt-ws-4.10.0-43.el9_2.24 +40
    • Red Hat Enterprise Linux Resilient Storage E4S (v.9.2) fence-agents-aliyun-4.10.0-43.el9_2.24, fence-agents-all-4.10.0-43.el9_2.24, fence-agents-amt-ws-4.10.0-43.el9_2.24 +39
  • RHSA-2026:50479 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.6 Container Release Update
    • Red Hat Ansible Automation Platform 2.6 registry.redhat.io/ansible-automation-platform-26/controller-rhel9, registry.redhat.io/ansible-automation-platform-26/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-26/de-supported-rhel9 +7
  • RHSA-2026:50317 Released 2026-08-04 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 9) fence-agents-4.10.0-110.el9_8.5, fence-agents-aliyun-4.10.0-110.el9_8.5, fence-agents-all-4.10.0-110.el9_8.5 +47
  • RHSA-2026:50357 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.5 Container Release Update
    • Red Hat Ansible Automation Platform 2.5 registry.redhat.io/ansible-automation-platform-25/ee-minimal-rhel8, registry.redhat.io/ansible-automation-platform-25/ee-supported-rhel8, registry.redhat.io/ansible-automation-platform-25/hub-rhel8 +1
  • RHSA-2026:50340 Released 2026-08-04 · Red Hat rating Important
    Red Hat Ansible Automation Platform 2.7 Container Release Update
    • Red Hat Ansible Automation Platform 2.7 registry.redhat.io/ansible-automation-platform-27/controller-rhel9, registry.redhat.io/ansible-automation-platform-27/de-minimal-rhel9, registry.redhat.io/ansible-automation-platform-27/de-supported-rhel9 +7
  • RHSA-2026:49911 Released 2026-08-04 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream EUS (v. 10.0) fence-agents-4.16.0-5.el10_0.12, fence-agents-aliyun-4.16.0-5.el10_0.12, fence-agents-all-4.16.0-5.el10_0.12 +47
  • RHSA-2026:48585 Released 2026-07-31 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 10) fence-agents-4.16.0-21.el10_2.5, fence-agents-aliyun-4.16.0-21.el10_2.5, fence-agents-all-4.16.0-21.el10_2.5 +47
  • RHSA-2026:48605 Released 2026-07-30 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream E4S (v.8.8) fence-agents-4.2.1-112.el8_8.19, fence-agents-all-4.2.1-112.el8_8.19, fence-agents-amt-ws-4.2.1-112.el8_8.19 +40
    • Red Hat Enterprise Linux AppStream TUS (v.8.8) fence-agents-4.2.1-112.el8_8.19, fence-agents-all-4.2.1-112.el8_8.19, fence-agents-amt-ws-4.2.1-112.el8_8.19 +39
    • Red Hat Enterprise Linux High Availability E4S (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.19, fence-agents-aws-4.2.1-112.el8_8.19, fence-agents-azure-arm-4.2.1-112.el8_8.19 +2
    • Red Hat Enterprise Linux High Availability TUS (v.8.8) fence-agents-aliyun-4.2.1-112.el8_8.19, fence-agents-aws-4.2.1-112.el8_8.19, fence-agents-azure-arm-4.2.1-112.el8_8.19 +2
  • RHSA-2026:48615 Released 2026-07-30 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.4) fence-agents-4.2.1-65.el8_4.30, fence-agents-all-4.2.1-65.el8_4.30, fence-agents-amt-ws-4.2.1-65.el8_4.30 +40
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4) fence-agents-4.2.1-65.el8_4.30, fence-agents-all-4.2.1-65.el8_4.30, fence-agents-amt-ws-4.2.1-65.el8_4.30 +36
    • Red Hat Enterprise Linux High Availability AUS (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.30, fence-agents-aws-4.2.1-65.el8_4.30, fence-agents-azure-arm-4.2.1-65.el8_4.30 +1
    • Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4) fence-agents-aliyun-4.2.1-65.el8_4.30, fence-agents-aws-4.2.1-65.el8_4.30, fence-agents-azure-arm-4.2.1-65.el8_4.30 +1
  • RHSA-2026:48604 Released 2026-07-30 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream AUS (v.8.6) fence-agents-4.2.1-89.el8_6.24, fence-agents-all-4.2.1-89.el8_6.24, fence-agents-amt-ws-4.2.1-89.el8_6.24 +40
    • Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6) fence-agents-4.2.1-89.el8_6.24, fence-agents-all-4.2.1-89.el8_6.24, fence-agents-amt-ws-4.2.1-89.el8_6.24 +40
    • Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6) fence-agents-aliyun-4.2.1-89.el8_6.24, fence-agents-aws-4.2.1-89.el8_6.24, fence-agents-azure-arm-4.2.1-89.el8_6.24 +1
  • RHSA-2026:47736 Released 2026-07-30 · Red Hat rating Important
    fence-agents security update
    • Red Hat Enterprise Linux AppStream (v. 8) fence-agents-4.2.1-129.el8_10.27, fence-agents-all-4.2.1-129.el8_10.27, fence-agents-amt-ws-4.2.1-129.el8_10.27 +41
    • Red Hat Enterprise Linux HighAvailability (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.27, fence-agents-aws-4.2.1-129.el8_10.27, fence-agents-azure-arm-4.2.1-129.el8_10.27 +2
    • Red Hat Enterprise Linux ResilientStorage (v. 8) fence-agents-aliyun-4.2.1-129.el8_10.27, fence-agents-aws-4.2.1-129.el8_10.27, fence-agents-azure-arm-4.2.1-129.el8_10.27 +2
  • RHSA-2026:43038 Released 2026-07-21 · Red Hat rating Critical
    Migration Toolkit for Applications
    • Red Hat Migration Toolkit for Applications 8.2 registry.redhat.io/mta/mta-cli-rhel9, registry.redhat.io/mta/mta-solution-server-rhel9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Ansible Automation Platform 2AffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Ansible Automation Platform 2.5Fixed RHSA-2026:50357
Red Hat Ansible Automation Platform 2.6Fixed RHSA-2026:50479
Red Hat Ansible Automation Platform 2.7Fixed RHSA-2026:50340
Red Hat Enterprise Linux AppStream (v. 10)Fixed RHSA-2026:48585
Red Hat Enterprise Linux AppStream (v. 8)Fixed RHSA-2026:47736
Red Hat Enterprise Linux AppStream (v. 9)Fixed RHSA-2026:50317
Red Hat Enterprise Linux AppStream AUS (v.8.4)Fixed RHSA-2026:48615
Red Hat Enterprise Linux AppStream AUS (v.8.6)Fixed RHSA-2026:48604
Red Hat Enterprise Linux AppStream E4S (v.8.8)Fixed RHSA-2026:48605
Red Hat Enterprise Linux AppStream E4S (v.9.2)Fixed RHSA-2026:50653
Red Hat Enterprise Linux AppStream E4S (v.9.4)Fixed RHSA-2026:50655
Red Hat Enterprise Linux AppStream EUS (v. 10.0)Fixed RHSA-2026:49911
Red Hat Enterprise Linux AppStream EUS (v.9.6)Fixed RHSA-2026:50654
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.4)Fixed RHSA-2026:48615
Red Hat Enterprise Linux AppStream EUS EXTENSION (v.8.6)Fixed RHSA-2026:48604
Red Hat Enterprise Linux AppStream TUS (v.8.8)Fixed RHSA-2026:48605
Red Hat Enterprise Linux High Availability AUS (v.8.4)Fixed RHSA-2026:48615
Red Hat Enterprise Linux High Availability E4S (v.8.8)Fixed RHSA-2026:48605
Red Hat Enterprise Linux High Availability E4S (v.9.2)Fixed RHSA-2026:50653
Red Hat Enterprise Linux High Availability E4S (v.9.4)Fixed RHSA-2026:50655
Red Hat Enterprise Linux High Availability EUS EXTENSION (v.8.6)Fixed RHSA-2026:48604
Red Hat Enterprise Linux High Availability TUS (v.8.8)Fixed RHSA-2026:48605
Red Hat Enterprise Linux HighAvailability (v. 8)Fixed RHSA-2026:47736
Red Hat Enterprise Linux HighAvailability EUS EXTENSION (v.8.4)Fixed RHSA-2026:48615
Red Hat Enterprise Linux Resilient Storage E4S (v.9.2)Fixed RHSA-2026:50653
Red Hat Enterprise Linux Resilient Storage E4S (v.9.4)Fixed RHSA-2026:50655
Red Hat Enterprise Linux ResilientStorage (v. 8)Fixed RHSA-2026:47736
Red Hat Migration Toolkit for Applications 8.2Fixed RHSA-2026:43038
Red Hat OpenShift AI 3.4Fixed RHSA-2026:84734
Not affected: 6 products
  • Red Hat Ansible Automation Platform 2.5
  • Red Hat Ansible Automation Platform 2.6
  • Red Hat Ansible Automation Platform 2.7
  • Red Hat Hardened Images
  • Red Hat Migration Toolkit for Applications 8.2
  • Red Hat OpenShift AI 3.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-59939
  2. 2026-10-03 Alias added: GHSA-j5g9-f88f-gfj3
  3. 2026-10-09 Affected versions changed · Red Hat
  4. 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
  5. 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat

References

Exploit 1

Patch 1

Advisory 1

Other 4

  • TI-2021-04343 Regular Expression Denial of Service in httplib2 CVSS 3.1HIGH 7.5
  • TI-2020-08952 CRLF injection in httplib2 CVSS 3.1MEDIUM 6.8
  • TI-2013-01808 httplib2 0.7.2, 0.8, and earlier, after an initial connection is made, does not verify… CVSS 2.0LOW 2.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences