httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.
Weakness
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Httplib2 | Httplib2_project | * | 0.32.0 (excluding) |
| Python-httplib2 | Ubuntu | devel | * |
| Python-httplib2 | Ubuntu | jammy | * |
| Python-httplib2 | Ubuntu | noble | * |
| Python-httplib2 | Ubuntu | questing | * |
| Python-httplib2 | Ubuntu | resolute | * |
| Python-httplib2 | Ubuntu | upstream | * |