CVE-2026-59939

HIGH

7.5

CVSS v3

Description

httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

CWE-409

How to fix

Remediation Available

python-httplib2Debian

Fixed in:0.18.1-3+deb11u1CVE-2026-59939

Fixed in:0.20.4-3+deb12u1CVE-2026-59939

Fixed in:0.22.0-1+deb13u1CVE-2026-59939

Fixed in:0.32.0-1CVE-2026-59939

fence-agentsRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agentsRocky

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agents-aliyunRed Hat / RHEL

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

fence-agents-aliyunRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-aliyun-debuginfoRed Hat / RHEL

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

fence-agents-aliyun-debuginfoRocky

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

fence-agents-allRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

fence-agents-allRocky

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

fence-agents-amt-wsRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-amt-wsRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

fence-agents-apcRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-apcRocky

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

fence-agents-apc-snmpRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

fence-agents-apc-snmpRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agents-awsRocky

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-awsRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

fence-agents-azure-armRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agents-azure-armRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-azure-arm-debuginfoRocky

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

fence-agents-azure-arm-debuginfoRed Hat / RHEL

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

fence-agents-bladecenterRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agents-bladecenterRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-brocadeRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

fence-agents-brocadeRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

fence-agents-cisco-mdsRed Hat / RHEL

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

Fixed in:0:4.10.0-86.el9_6.19RHSA-2026:50654

fence-agents-cisco-mdsRocky

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

fence-agents-cisco-ucsRocky

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.10.0-43.el9_2.24RHSA-2026:50653

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agents-cisco-ucsRed Hat / RHEL

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.2.1-89.el8_6.24RHSA-2026:48604

Fixed in:0:4.2.1-65.el8_4.30RHSA-2026:48615

Fixed in:0:4.2.1-112.el8_8.19RHSA-2026:48605

Fixed in:0:4.2.1-129.el8_10.27RHSA-2026:47736

Fixed in:0:4.10.0-62.el9_4.27RHSA-2026:50655

Fixed in:0:4.10.0-110.el9_8.5RHSA-2026:50317

fence-agents-commonRed Hat / RHEL

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

Fixed in:0:4.16.0-21.el10_2.5RHSA-2026:48585

Fixed in:0:4.16.0-5.el10_0.12RHSA-2026:49911

This vulnerability affects an unusually large number of packages. The highest-confidence fixes are shown above; the full list is longer. Check the referenced advisories for complete coverage.

TridentStack Control can deploy fixes like this automatically across your Windows, macOS, and Linux fleet. See how it works

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorNetwork

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityNone

IntegrityNone

AvailabilityHigh

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploit Intelligence

0.42%probability of exploitation in 30 days

35thpercentile

Low risk: more likely to be exploited than 35% of all known CVEs.

References

Patch1

github.com

Exploit1

github.com

Release Notes1

github.com

Other references1

lists.debian.org

Related Vulnerabilities

Other CWE-409 vulnerabilities, ordered by exploit likelihood. View all

CVE	Severity	CVSS	EPSS	Exploited	Fix
CVE-2026-49975	High	7.5	31%	-	Fix
CVE-2026-21441	High	7.5	2.8%	-	Fix
CVE-2024-43499	High	7.5	2.6%	-	Fix
CVE-2024-28180	Medium	4.3	2.0%	-	Fix
CVE-2017-16129	Medium	5.9	1.8%	-	Fix
CVE-2022-29225	High	7.5	1.6%	-	Fix

Common questions

How do I fix CVE-2026-59939?

Published advisories record a fix for 261 affected products. The "How to fix" section on this page lists the fixed version and source advisory for each one, so apply the entry matching what you actually run.

Is CVE-2026-59939 being actively exploited?

Not that we know of. CVE-2026-59939 is not in the CISA Known Exploited Vulnerabilities catalog. Its EPSS score of 0.42% is the estimated probability that it will be exploited in the next 30 days. That is higher than 35% of all scored CVEs.

How severe is CVE-2026-59939?

CVE-2026-59939 has a CVSS v3 base score of 7.5, rated high. CVSS rates the technical impact if the vulnerability is exploited, not how likely that is, so weigh it alongside the exploit-prediction score when you decide what to patch first.

What does CVE-2026-59939 affect?

Published advisories record a fix for python-httplib2 (Debian), fence-agents (Red Hat / RHEL), fence-agents (Rocky), fence-agents-aliyun (Red Hat / RHEL), and 257 more. Only products with a sourced advisory are listed, so treat this as what we can cite rather than a complete inventory.

Embed a live status badge for CVE-2026-59939

Markdown

[![CVE-2026-59939](https://tridentstack.com/cve/badge/CVE-2026-59939.svg)](https://tridentstack.com/cve/CVE-2026-59939)

HTML

<a href="https://tridentstack.com/cve/CVE-2026-59939"><img src="https://tridentstack.com/cve/badge/CVE-2026-59939.svg" alt="CVE-2026-59939"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

See how it works Start freeThis CVE lookup is free and always will be.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2026-08-20.