{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/vendors/httplib2/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:httplib2_project:httplib2:*:*:*:*:*:python:*:*"],"_cs_cves":[{"cvss":7.5,"id":"CVE-2026-59939"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["httplib2 (\u003c 0.32.0)","google-api-python-client","google-auth-httplib2"],"_cs_severities":["low"],"_cs_tags":["denial-of-service","vulnerability","python","client-side"],"_cs_type":"advisory","_cs_vendors":["httplib2","Google"],"content_html":"\u003cp\u003eA critical denial-of-service vulnerability (CVE-2026-59939) has been identified in the \u003ccode\u003ehttplib2\u003c/code\u003e Python client library, specifically in versions prior to 0.32.0. This flaw stems from the library's unbounded decompression of HTTP response bodies that are encoded with \u003ccode\u003egzip\u003c/code\u003e or \u003ccode\u003edeflate\u003c/code\u003e. Attackers can exploit this by controlling an HTTP server or acting as a Man-in-the-Middle (MITM) to send a seemingly small compressed payload (e.g., 150 KB) that, upon automatic decompression by \u003ccode\u003ehttplib2\u003c/code\u003e's \u003ccode\u003e_decompressContent()\u003c/code\u003e function, expands into an arbitrarily large amount of memory (e.g., 150 MB or more). This massive memory consumption leads to \u003ccode\u003eMemoryError\u003c/code\u003e exceptions or an Out-Of-Memory (OOM) kill of the client process, effectively causing a denial of service. Applications using \u003ccode\u003ehttplib2.Http().request()\u003c/code\u003e against untrusted or attacker-controlled endpoints are at risk, including downstream dependencies like \u003ccode\u003egoogle-api-python-client\u003c/code\u003e and \u003ccode\u003egoogle-auth-httplib2\u003c/code\u003e, which may inadvertently expose their users to this vulnerability.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAn attacker gains control over an HTTP server or establishes a Man-in-the-Middle (MITM) position capable of intercepting and modifying HTTP responses.\u003c/li\u003e\n\u003cli\u003eA client application, using the vulnerable \u003ccode\u003ehttplib2\u003c/code\u003e library (versions \u003ccode\u003e\u0026lt; 0.32.0\u003c/code\u003e), initiates an HTTP request to the attacker-controlled or compromised endpoint.\u003c/li\u003e\n\u003cli\u003eThe malicious server responds to the client's request, including a \u003ccode\u003eContent-Encoding: gzip\u003c/code\u003e or \u003ccode\u003eContent-Encoding: deflate\u003c/code\u003e header in the HTTP response.\u003c/li\u003e\n\u003cli\u003eThe server transmits a small, specially crafted compressed payload (e.g., 150 KB) designed to expand significantly (e.g., 150 MB) upon decompression.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003ehttplib2\u003c/code\u003e library, specifically the \u003ccode\u003e_decompressContent()\u003c/code\u003e function within \u003ccode\u003ehttplib2/__init__.py\u003c/code\u003e, automatically buffers the full compressed body and attempts to decompress it.\u003c/li\u003e\n\u003cli\u003eThe \u003ccode\u003egzip.GzipFile(fileobj=io.BytesIO(new_content)).read()\u003c/code\u003e or \u003ccode\u003ezlib.decompress(content, zlib.MAX_WBITS)\u003c/code\u003e calls proceed to decompress the entire payload into memory without any size limits or sanity checks.\u003c/li\u003e\n\u003cli\u003eThis unbounded decompression consumes a disproportionate and ever-growing amount of the client process's memory resources.\u003c/li\u003e\n\u003cli\u003eThe excessive memory consumption culminates in a \u003ccode\u003eMemoryError\u003c/code\u003e exception within the client application or an operating system-level Out-Of-Memory (OOM) kill of the client process, causing a denial-of-service condition.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThis vulnerability carries a high severity, as any application using \u003ccode\u003ehttplib2\u003c/code\u003e to make HTTP requests to untrusted servers is susceptible. The attack requires no authentication, specific configuration, or user interaction; the server merely needs to return a specially crafted compressed response. A 150 KB compressed payload can amplify over 1,000 times to 150 MB of decompressed data, making the attack highly effective. Attackers can scale this, where even a 1 MB compressed payload can lead to gigabytes of decompressed data, ensuring an OOM-kill on most systems. Real-world scenarios include web scrapers, API clients connecting to third-party services, webhook handlers, and CI/CD pipelines downloading artifacts. \u003ccode\u003ehttplib2\u003c/code\u003e is a widely used Python library, and its dependency in Google's API client libraries (\u003ccode\u003egoogle-api-python-client\u003c/code\u003e, \u003ccode\u003egoogle-auth-httplib2\u003c/code\u003e) extends the potential impact to numerous applications relying on Google Cloud APIs, indirectly exposing them to this denial-of-service vector.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade the \u003ccode\u003ehttplib2\u003c/code\u003e library to version 0.32.0 or later immediately to address CVE-2026-59939.\u003c/li\u003e\n\u003cli\u003eImplement resource limits at the operating system or application level to prevent unbounded memory consumption by client processes, particularly those interacting with untrusted HTTP endpoints.\u003c/li\u003e\n\u003cli\u003eReview applications using \u003ccode\u003ehttplib2\u003c/code\u003e, \u003ccode\u003egoogle-api-python-client\u003c/code\u003e, or \u003ccode\u003egoogle-auth-httplib2\u003c/code\u003e to understand their exposure to untrusted HTTP response sources.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-24T15:16:49Z","date_published":"2026-07-24T15:16:49Z","id":"https://feed.craftedsignal.io/briefs/2026-07-httplib2-decompression-bomb/","summary":"A high-severity vulnerability in the `httplib2` Python client library allows a remote attacker to trigger a denial-of-service condition by sending a crafted HTTP response with a small, highly compressed payload that expands excessively upon decompression, causing memory exhaustion or OOM-kill in the client process.","title":"httplib2 Decompression Bomb Denial of Service via Unbounded Gzip/Deflate Handling","url":"https://feed.craftedsignal.io/briefs/2026-07-httplib2-decompression-bomb/"}],"language":"en","title":"CraftedSignal Threat Feed - Httplib2","version":"https://jsonfeed.org/version/1.1"}