https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 14:20:34 +0000 https://cve.radiocsirt.org/vuln/alsa-2026:47736 <p><strong>Affected:</strong> AlmaLinux:8: fence-agents-aliyun, AlmaLinux:8: fence-agents-all, AlmaLinux:8: fence-agents-amt-ws, AlmaLinux:8: fence-agents-apc, AlmaLinux:8: fence-agents-apc-snmp, AlmaLinux:8: fence-agents-aws, AlmaLinux:8: fence-agents-azure-arm, AlmaLinux:8: fence-agents-bladecenter, AlmaLinux:8: fence-agents-brocade, AlmaLinux:8: fence-agents-cisco-mds and 38 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> AlmaLinux:8: fence-agents-aliyun, AlmaLinux:8: fence-agents-all, AlmaLinux:8: fence-agents-amt-ws, AlmaLinux:8: fence-agents-apc, AlmaLinux:8: fence-agents-apc-snmp, AlmaLinux:8: fence-agents-aws, AlmaLinux:8: fence-agents-azure-arm, AlmaLinux:8: fence-agents-bladecenter, AlmaLinux:8: fence-agents-brocade, AlmaLinux:8: fence-agents-cisco-mds and 38 more</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/alsa-2026:47736 https://cve.radiocsirt.org/vuln/brew-charmcraft-cve-2026-59939 <p><strong>Affected:</strong> Homebrew: charmcraft</p> <p>### Summary</p> <p>The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.</p> <p>Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.</p> <p>### Details</p> <p>**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function</p> <p>The decompression path has two unbounded operations:</p> <p>1. **gzip decompression** (line 394): ```python content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read() ``` The `.read()` call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.</p> <p>2. **deflate decompression** (line 397): ```python content = zlib.decompress(content, zlib.MAX_WBITS) ``` Similarly, `zlib.decompress()` returns the fully decompressed content as a single bytes object with no size bound.</p> <p>3. **Automatic invocation** (line 1431): `_decompressContent()` is called automatically on every HTTP response that includes a `Content-Encoding: gzip` or `deflate` header. The full compressed body is already buffered in memory via `response.read(…</p> <p><strong>Affected:</strong> Homebrew: charmcraft</p> <p>### Summary</p> <p>The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.</p> <p>Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.</p> <p>### Details</p> <p>**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function</p> <p>The decompression path has two unbounded operations:</p> <p>1. **gzip decompression** (line 394): ```python content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read() ``` The `.read()` call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.</p> <p>2. **deflate decompression** (line 397): ```python content = zlib.decompress(content, zlib.MAX_WBITS) ``` Similarly, `zlib.decompress()` returns the fully decompressed content as a single bytes object with no size bound.</p> <p>3. **Automatic invocation** (line 1431): `_decompressContent()` is called automatically on every HTTP response that includes a `Content-Encoding: gzip` or `deflate` header. The full compressed body is already buffered in memory via `response.read(…</p> https://cve.radiocsirt.org/vuln/brew-charmcraft-cve-2026-59939 https://cve.radiocsirt.org/vuln/cleanstart-2026-bc02149 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: airflow-3</p> <p>Package airflow-3 version 3.1.8-r6 fixes 13 vulnerabilities: CVE-2026-53533, CVE-2026-59885, CVE-2026-59886, CVE-2026-59890, CVE-2026-49476...</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-bc02149 https://cve.radiocsirt.org/vuln/euvd-2026-357111 EUVD-2026-357111 https://cve.radiocsirt.org/vuln/euvd-2026-357111 https://cve.radiocsirt.org/vuln/fkie_cve-2026-59939 <p>httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.</p> <p>httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-59939 https://cve.radiocsirt.org/vuln/ghsa-j5g9-f88f-gfj3 <p><strong>Affected:</strong> PyPI: httplib2</p> <p>### Summary</p> <p>The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.</p> <p>Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.</p> <p>### Details</p> <p>**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function</p> <p>The decompression path has two unbounded operations:</p> <p>1. **gzip decompression** (line 394): ```python content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read() ``` The `.read()` call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.</p> <p>2. **deflate decompression** (line 397): ```python content = zlib.decompress(content, zlib.MAX_WBITS) ``` Similarly, `zlib.decompress()` returns the fully decompressed content as a single bytes object with no size bound.</p> <p>3. **Automatic invocation** (line 1431): `_decompressContent()` is called automatically on every HTTP response that includes a `Content-Encoding: gzip` or `deflate` header. The full compressed body is already buffered in memory via `response.read(…</p> <p><strong>Affected:</strong> PyPI: httplib2</p> <p>### Summary</p> <p>The `httplib2` HTTP client library performs unbounded decompression of HTTP response bodies encoded with `Content-Encoding: gzip` or `deflate`. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing `MemoryError` or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client.</p> <p>Any application using `httplib2.Http().request()` against untrusted or attacker-controlled HTTP endpoints is affected.</p> <p>### Details</p> <p>**Affected code:** `httplib2/__init__.py` - `_decompressContent()` function</p> <p>The decompression path has two unbounded operations:</p> <p>1. **gzip decompression** (line 394): ```python content = gzip.GzipFile(fileobj=io.BytesIO(new_content)).read() ``` The `.read()` call with no size argument decompresses the entire gzip payload into a single in-memory bytes object. There is no limit on the decompressed size.</p> <p>2. **deflate decompression** (line 397): ```python content = zlib.decompress(content, zlib.MAX_WBITS) ``` Similarly, `zlib.decompress()` returns the fully decompressed content as a single bytes object with no size bound.</p> <p>3. **Automatic invocation** (line 1431): `_decompressContent()` is called automatically on every HTTP response that includes a `Content-Encoding: gzip` or `deflate` header. The full compressed body is already buffered in memory via `response.read(…</p> https://cve.radiocsirt.org/vuln/ghsa-j5g9-f88f-gfj3 https://cve.radiocsirt.org/vuln/opensuse-su-2026:21526-1 <p>Security update for python-httplib2</p> <p>Security update for python-httplib2</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:21526-1 https://cve.radiocsirt.org/vuln/pysec-2026-3444 <p><strong>Affected:</strong> PyPI: httplib2</p> <p>httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.</p> <p><strong>Affected:</strong> PyPI: httplib2</p> <p>httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3444 https://cve.radiocsirt.org/vuln/rhsa-2026:43038 <p>jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list net/mail: golang: net/mail…</p> <p>jupyter-server: jupyter-server: Sensitive data exposure via path traversal vulnerability fast-uri: fast-uri: URI authority bypass due to improper delimiter handling fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization golang.org/x/net/html: golang.org/x/net/html: Arbitrary code execution via Cross-Site Scripting golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass python-dotenv: python-dotenv: Arbitrary file overwrite via symbolic link following mistune: Mistune: Regular Expression Denial of Service (ReDoS) via crafted Markdown input net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME aiohttp: AIOHTTP: Arbitrary code execution via untrusted input to CookieJar.load() jupyter-server: Jupyter Server: Unauthorized File Access via Path Traversal Vulnerability net/mail: golang: Go net/mail: Denial of Service via crafted email inputs golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing jupyter-server: Jupyter Server: Cross-Origin Resource Sharing (CORS) bypass via improper Origin header validation Jupyter Notebook: JupyterLab: @jupyter-notebook/help-extension: @jupyterlab/help-extension: Jupyter Notebook and JupyterLab: Session takeover via stored cross-site scripting jupyterlab: JupyterLab: Arbitrary code execution due to improper enforcement of extension allow-list net/mail: golang: net/mail…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:43038 https://cve.radiocsirt.org/vuln/rlsa-2026:47736 <p><strong>Affected:</strong> Rocky Linux:8: fence-agents</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> <p><strong>Affected:</strong> Rocky Linux:8: fence-agents</p> <p>The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.</p> <p>Security Fix(es):</p> <p>* httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies (CVE-2026-59939)</p> <p>For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.</p> https://cve.radiocsirt.org/vuln/rlsa-2026:47736 https://cve.radiocsirt.org/vuln/suse-su-2026:23120-1 <p>Security update for python-httplib2</p> <p>Security update for python-httplib2</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23120-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59939 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: python-httplib2, Ubuntu:16.04:LTS: python-httplib2, Ubuntu:18.04:LTS: python-httplib2, Ubuntu:20.04:LTS: python-httplib2, Ubuntu:22.04:LTS: python-httplib2, Ubuntu:24.04:LTS: python-httplib2, Ubuntu:25.10: python-httplib2, Ubuntu:26.04:LTS: python-httplib2</p> <p>httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: python-httplib2, Ubuntu:16.04:LTS: python-httplib2, Ubuntu:18.04:LTS: python-httplib2, Ubuntu:20.04:LTS: python-httplib2, Ubuntu:22.04:LTS: python-httplib2, Ubuntu:24.04:LTS: python-httplib2, Ubuntu:25.10: python-httplib2, Ubuntu:26.04:LTS: python-httplib2</p> <p>httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-59939 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2588 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat Enterprise Linux ausnutzen, um einen Denial of Service Angriff durchzuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2588