Summary
It was discovered that httplib2 performed unbounded decompression of HTTP
response bodies when the server used gzip or deflate Content-Encoding. A
remote attacker could possibly use this issue to cause httplib2 to use
excessive resources, leading to a denial of service.
Fixed packages 3
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | python-httplib2 | 0.20.2-2ubuntu0.1 |
| Ubuntu · 24.04 LTS 24.04:LTS | python-httplib2 | 0.20.4-3ubuntu0.1 |
| Ubuntu · 26.04 LTS 26.04:LTS | python-httplib2 | 0.22.0-1ubuntu0.1 |
Vulnerabilities 1
-
High 7.5
httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling
httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or co…
References
-
report
https://ubuntu.com/security/CVE-2026-59939