httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client process. This issue is fixed in version 0.32.0.

oracle_linux ELSA-2026-47736: ELSA-2026-47736:  fence-agents security update (IMPORTANT)

The remote Oracle Linux 10 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-48585 advisory.

    [4.16.0-21.5]
    - bundled httplib2: upgrade to v0.32.0 to fix CVE-2026-59939       Resolves: RHEL-193812

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:48605 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies     (CVE-2026-59939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:48604 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies     (CVE-2026-59939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:47736 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies     (CVE-2026-59939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:48615 advisory.

    The fence-agents packages provide a collection of scripts for handling remote power management for cluster     devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

    Security Fix(es):

    * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies     (CVE-2026-59939)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote RockyLinux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2026:47736 advisory.

    * httplib2: httplib2: Denial of Service via unbounded decompression of HTTP response bodies     (CVE-2026-59939)

Tenable has extracted the preceding description block directly from the RockyLinux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded
    decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent
    in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload
    that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client
    process. This issue is fixed in version 0.32.0. (CVE-2026-59939)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-8537-1 advisory.

    It was discovered that httplib2 performed unbounded decompression of HTTP response bodies when the server     used gzip or deflate Content-Encoding. A remote attacker could possibly use this issue to cause httplib2     to use excessive resources, leading to a denial of service.

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - httplib2 is a comprehensive HTTP client library for Python. Prior to 0.32.0, httplib2 performs unbounded     decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate in _decompressContent     in httplib2/init.py, allowing a malicious or compromised HTTP server to return a small compressed payload     that expands to an arbitrarily large size in memory and causes MemoryError or OOM-kill in the client     process. This issue is fixed in version 0.32.0. (CVE-2026-59939)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Severity
331300	Oracle Linux 10 : fence-agents (ELSA-2026-48585)	Nessus	Oracle Linux Local Security Checks	high
331291	RHEL 8 : fence-agents (RHSA-2026:48605)	Nessus	Red Hat Local Security Checks	high
331290	RHEL 8 : fence-agents (RHSA-2026:48604)	Nessus	Red Hat Local Security Checks	high
330870	RHEL 8 : fence-agents (RHSA-2026:47736)	Nessus	Red Hat Local Security Checks	high
330868	RHEL 8 : fence-agents (RHSA-2026:48615)	Nessus	Red Hat Local Security Checks	high
330846	RockyLinux 8 : fence-agents (RLSA-2026:47736)	Nessus	Rocky Linux Local Security Checks	high
445309	SCA: security update for httplib2 (GHSA-j5g9-f88f-gfj3)	Tenable Cloud Security	SCA Checks	high
445309	SCA: security update for httplib2 (GHSA-j5g9-f88f-gfj3)	Tenable Self-Hosted Container Security	SCA Checks	high
327064	Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS : httplib2 vulnerability (USN-8537-1)	Nessus	Ubuntu Local Security Checks	high
325956	Linux Distros Unpatched Vulnerability : CVE-2026-59939	Nessus	Misc.	high

Detections

Analytics

CVE-2026-59939

high

Tenable Plugins

Coming Soon

high

high

high

high

high

high

high

high

high

high