Bug 2498212 (CVE-2026-59939) - CVE-2026-59939 httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies
Summary: CVE-2026-59939 httplib2: httplib2: Denial of Service via unbounded decompress...
Keywords:
Status: NEW
Alias: CVE-2026-59939
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-08 20:02 UTC by OSIDB Bzimport
Modified: 2026-08-05 06:19 UTC (History)
20 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:47736 0 None None None 2026-07-29 12:13:08 UTC
Red Hat Product Errata RHSA-2026:48585 0 None None None 2026-07-30 15:48:05 UTC
Red Hat Product Errata RHSA-2026:48604 0 None None None 2026-07-30 06:50:42 UTC
Red Hat Product Errata RHSA-2026:48605 0 None None None 2026-07-30 07:33:43 UTC
Red Hat Product Errata RHSA-2026:48615 0 None None None 2026-07-30 06:54:06 UTC
Red Hat Product Errata RHSA-2026:49911 0 None None None 2026-08-04 07:03:00 UTC
Red Hat Product Errata RHSA-2026:50317 0 None None None 2026-08-04 20:15:12 UTC
Red Hat Product Errata RHSA-2026:50653 0 None None None 2026-08-05 06:07:21 UTC
Red Hat Product Errata RHSA-2026:50654 0 None None None 2026-08-05 06:13:34 UTC
Red Hat Product Errata RHSA-2026:50655 0 None None None 2026-08-05 06:19:53 UTC

Description OSIDB Bzimport 2026-07-08 20:02:34 UTC 
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Comment 2 errata-xmlrpc 2026-07-29 12:13:06 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2026:47736 https://access.redhat.com/errata/RHSA-2026:47736
Comment 3 errata-xmlrpc 2026-07-30 06:50:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.6 Extended Update Support Long-Life Add-On

Via RHSA-2026:48604 https://access.redhat.com/errata/RHSA-2026:48604
Comment 4 errata-xmlrpc 2026-07-30 06:54:05 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support
  Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On

Via RHSA-2026:48615 https://access.redhat.com/errata/RHSA-2026:48615
Comment 5 errata-xmlrpc 2026-07-30 07:33:41 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions
  Red Hat Enterprise Linux 8.8 Telecommunications Update Service

Via RHSA-2026:48605 https://access.redhat.com/errata/RHSA-2026:48605
Comment 6 errata-xmlrpc 2026-07-30 15:48:04 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:48585 https://access.redhat.com/errata/RHSA-2026:48585
Comment 7 errata-xmlrpc 2026-08-04 07:02:59 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:49911 https://access.redhat.com/errata/RHSA-2026:49911
Comment 8 errata-xmlrpc 2026-08-04 20:15:10 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:50317 https://access.redhat.com/errata/RHSA-2026:50317
Comment 9 errata-xmlrpc 2026-08-05 06:07:19 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:50653 https://access.redhat.com/errata/RHSA-2026:50653
Comment 10 errata-xmlrpc 2026-08-05 06:13:32 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:50654 https://access.redhat.com/errata/RHSA-2026:50654
Comment 11 errata-xmlrpc 2026-08-05 06:19:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:50655 https://access.redhat.com/errata/RHSA-2026:50655
Note You need to log in before you can comment on or make changes to this bug.