httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

QFinch assessment

The httplib2 HTTP client library performs unbounded decompression of HTTP response bodies encoded with Content-Encoding: gzip or deflate. A malicious or compromised HTTP server can return a small compressed payload (approximately 150 KB) that expands to an arbitrarily large size in memory (150 MB or more), causing MemoryError or OOM-kill in the client process. This is a classic decompression bomb (zip bomb) attack against the HTTP client. Any application using httplib2.Http().request() against untrusted or attacker-controlled HTTP endpoints is affected.

Potential impact

Severity: High Any application using httplib2 to make HTTP requests to untrusted servers is vulnerable. The attack requires no authentication, no special configuration, and no user interaction - the server simply returns a crafted gzip-compressed response. | Parameter | Value | |---|---| | Compressed payload | ~150 KB | | Decompressed size | 150 MB (configurable by attacker) | | Amplification ratio | ~1,029x | | Authentication required | None | | User interaction required | None | | Prerequisites | Client makes any HTTP request to attacker-controlled server | Real-world scenarios: - Web scrapers/crawlers that fetch pages from untrusted URLs - API clients connecting to third-party services - Webhook handlers that follow redirects to attacker-controlled endpoints - CI/CD pipelines that download dependencies or artifacts over HTTP - Any MITM attacker on an unencrypted HTTP connection can inject the compressed payload Impact scaling: The attacker can create arbitrarily large decompression bombs. A 1 MB compressed payload can decompress to several gigabytes, guaranteeing OOM-kill on virtually any system. The attack is fully deterministic and requires only a single HTTP response. Downstream exposure: httplib2 is a widely used Python HTTP client library with millions of downloads. It is a dependency of Google's API client libraries (google-api-python-client, google-auth-httplib2), meaning applications using Google Cloud APIs may be indirectly affected if they process responses from untrusted intermediaries. ---

Technical context

Affected code: httplib2/init.py - decompressContent() function The decompression path has two unbounded operations: 1. gzip decompression (line 394): 2. deflate decompression (line 397): 3. Automatic invocation (line 1431): decompressContent() is called automatically on every HTTP response that includes a Content-Encoding: gzip or deflate header. The full compressed body is already buffered in memory via response.read() before decompression begins. Root cause: There is no maxdecompressedsize, streaming decompression with size tracking, or decompression ratio check anywhere in the decompression path. The library unconditionally trusts the server's compressed payload size. Attack vector: Any HTTP server (including man-in-the-middle attackers or compromised upstream services) can trigger this by returning a response with: - Content-Encoding: gzip header - A small compressed body that decompresses to an arbitrarily large size