Summary
Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-59939: httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Fixed packages 41
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2 | fence-agents-aliyun | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-all | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-amt-ws | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-apc | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-apc-snmp | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-aws | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-bladecenter | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-brocade | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-cisco-mds | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-cisco-ucs | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-common | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-compute | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-debuginfo | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-drac5 | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-eaton-snmp | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-emerson | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-eps | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-gce | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-heuristics-ping | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-hpblade | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ibmblade | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ifmib | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ilo-moonshot | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ilo-mp | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ilo-ssh | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ilo2 | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-intelmodular | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ipdu | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-ipmilan | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-kdump | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-mpath | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-redfish | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-rhevm | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-rsa | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-rsb | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-sbd | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-scsi | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-virsh | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-vmware-rest | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-vmware-soap | 0:4.2.1-24.amzn2.0.4 |
| Amazon Linux · 2 | fence-agents-wti | 0:4.2.1-24.amzn2.0.4 |
Vulnerabilities 1
-
High 7.5
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or co…
References
-
web
https://alas.aws.amazon.com/cve/html/CVE-2026-59939.html