StackRadar

CVE-2026-59939

High

Advisory

Published 8 Jul 2026In the index since 5 Sept 2026
Severity
High
worst across findings
CVSS
7.5
base score, highest
EPSS
0.004
36th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
91
of 17,781 indexed, latest versions
Container images
103
deployed by those charts
Fix available
2 of 2
affected packages

httplib2: Decompression Bomb Denial of Service via Unbounded gzip/deflate Response Handling

Carried by container images the latest versions of 91 of 17,781 indexed charts deploy, on 103 images.

Affected packageAffected versionsFixed inImages
httplib2pypi0.8, 0.11.3, 0.12.1, 0.14.0+11 more0.32.0103
python-httplib2deb0.8-2build1, 0.14.0-1ubuntu1, 0.20.2-2, 0.20.4-30.20.2-2ubuntu0.1, 0.20.4-3ubuntu0.112
OSV records
GHSA-j5g9-f88f-gfj3UBUNTU-CVE-2026-59939
Also known as
PYSEC-2026-3444, USN-8537-1

Charts affected

91 by stars
ChartLatestAffected imagesRadar Score
airflowairflow-helmVerified publisher8.9.01 of 4See more

airflow airflow-helm 8.9.0

1 of the 4 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
apache/airflow:2.8.4-python3.964e58748b6b9
httplib2@0.22.0
0.32.0

Open the chart page →

11,367
oncallgrafana1.16.51 of 12See more

oncall grafana 1.16.5

1 of the 12 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
grafana/oncall:v1.16.5499851658393
httplib2@0.22.0
0.32.0

Open the chart page →

16,251
home-assistantgeek-cookbookVerified publisher13.5.01 of 1See more

home-assistant geek-cookbook 13.5.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2022.5.4ec6d67fbedfa
httplib2@0.20.4
0.32.0

Open the chart page →

7,705
redashredash4.2.01 of 3See more

redash redash 4.2.0

1 of the 3 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
redash/redash:25.8.000d813437db5
httplib2@0.19.0
0.32.0

Open the chart page →

5,987
homeassistantvolker-raschekVerified publisher0.2.31 of 1See more

homeassistant volker-raschek 0.2.3

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
homeassistant/home-assistant:2023.12.48d000332b09b
httplib2@0.20.4
0.32.0

Open the chart page →

6,041
supersetcloudposse1.2.01 of 1See more

superset cloudposse 1.2.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
httplib2@0.15.0
0.32.0

Open the chart page →

5,851
stackstorm-hastackstormVerified publisher1.1.011 of 17See more

stackstorm-ha stackstorm 1.1.0

11 of the 17 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
stackstorm/st2actionrunner:3.888235ba70cad
httplib2@0.22.0
0.32.0
stackstorm/st2api:3.86f56d239d280
httplib2@0.22.0
0.32.0
stackstorm/st2auth:3.833ecfda16608
httplib2@0.22.0
0.32.0
stackstorm/st2garbagecollector:3.84e3f8c7ca52d
httplib2@0.22.0
0.32.0
stackstorm/st2notifier:3.8f190a6212195
httplib2@0.22.0
0.32.0
stackstorm/st2rulesengine:3.8259503496ff9
httplib2@0.22.0
0.32.0
stackstorm/st2scheduler:3.8b1de2055c362
httplib2@0.22.0
0.32.0
stackstorm/st2sensorcontainer:3.8b1a338f64773
httplib2@0.22.0
0.32.0
stackstorm/st2stream:3.81c8904a3bf67
httplib2@0.22.0
0.32.0
stackstorm/st2timersengine:3.81bf35bfaf00c
httplib2@0.22.0
0.32.0
stackstorm/st2workflowengine:3.819fdfffdbba8
httplib2@0.22.0
0.32.0

Open the chart page →

96,419
openclawopenclawVerified publisher1.91.31 of 2See more

openclaw openclaw 1.91.3

1 of the 2 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.56.7b1ba7b054af2
httplib2@0.20.4
0.32.0

Open the chart page →

2,977
dependabot-gitlabdependabot-gitlabVerified publisher6.3.01 of 3See more

dependabot-gitlab dependabot-gitlab 6.3.0

1 of the 3 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
andrcuns/dependabot-gitlab:7.7.0-alpha.143060f159f4c
httplib2@0.20.4
0.32.0

Open the chart page →

4,556
fadicetic0.3.11 of 25See more

fadi cetic 0.3.1

1 of the 25 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
amancevice/superset:0.35.212a0a9e66550
httplib2@0.15.0
0.32.0

Open the chart page →

52,919
seafiledatamateVerified publisher0.6.01 of 6See more

seafile datamate 0.6.0

1 of the 6 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
datamate/seafile-professional:11.0.202dd66b722464
httplib2@0.20.2
python-httplib2@0.20.2-2
0.32.0
0.20.2-2ubuntu0.1

Open the chart page →

27,267
karakeephelmforgeVerified publisher1.2.91 of 3See more

karakeep helmforge 1.2.9

1 of the 3 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/browserless/chromium:v2.55.42ed0183564d7
httplib2@0.20.4
0.32.0

Open the chart page →

9,460
hertzbeathertzbeatOfficialVerified publisher1.8.12 of 4See more

hertzbeat hertzbeat 1.8.1

2 of the 4 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
apache/hertzbeat:1.8.075d48a62748f
httplib2@0.20.4
python-httplib2@0.20.4-3
0.32.0
0.20.4-3ubuntu0.1
apache/hertzbeat-collector:1.8.0a2bab1be574c
httplib2@0.20.4
python-httplib2@0.20.4-3
0.32.0
0.20.4-3ubuntu0.1

Open the chart page →

14,000
alerta-webalerta-webVerified publisher0.1.121 of 2See more

alerta-web alerta-web 0.1.12

1 of the 2 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
hayk96/alerta-web:9.0.486377705e9e3
httplib2@0.22.0
0.32.0

Open the chart page →

3,569
openshift-secured-pgadmineximiaitVerified publisher0.2.01 of 2See more

openshift-secured-pgadmin eximiait 0.2.0

1 of the 2 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
dpage/pgadmin4:7.537946e4f3e7b
httplib2@0.22.0
0.32.0

Open the chart page →

14,546
calibre-webk8s-home-lab-repo9.1.11 of 1See more

calibre-web k8s-home-lab-repo 9.1.1

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/linuxserver/calibre-web:0.6.267c0464228f2f
httplib2@0.22.0
0.32.0

Open the chart page →

4,477
home-assistantk8s-home-lab-repo16.3.11 of 1See more

home-assistant k8s-home-lab-repo 16.3.1

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/home-operations/home-assistant:2026.3.1067e54e2e107
httplib2@0.20.4
0.32.0

Open the chart page →

4,634
flagsmithone-acre-fundVerified publisher0.1.51 of 6See more

flagsmith one-acre-fund 0.1.5

1 of the 6 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
flagsmith/flagsmith-api:v2.6.0fd58556339a4
httplib2@0.18.1
0.32.0

Open the chart page →

6,868
open-zaakopen-zaak0.8.01 of 3See more

open-zaak open-zaak 0.8.0

1 of the 3 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
openzaak/open-zaak:1.6.02ca2ea6e0ae9
httplib2@0.20.4
0.32.0

Open the chart page →

4,045
anteonanteonVerified publisher2.6.41 of 13See more

anteon anteon 2.6.4

1 of the 13 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ddosify/selfhosted_backend:3.2.93c11e3182652
httplib2@0.22.0
0.32.0

Open the chart page →

22,202
tikaapache-tika3.2.21 of 1See more

tika apache-tika 3.2.2

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
apache/tika:3.2.2.0-fullffab324253ed
httplib2@0.22.0
0.32.0

Open the chart page →

437
seafiledr300481Verified publisher0.12.11 of 1See more

seafile dr300481 0.12.1

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
seafileltd/seafile-mc:11.0.12d0c66e4621bd
httplib2@0.20.2
python-httplib2@0.20.2-2
0.32.0
0.20.2-2ubuntu0.1

Open the chart page →

10,858
obicogabe565Verified publisher0.6.01 of 3See more

obico gabe565 0.6.0

1 of the 3 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/gabe565/obico/web:latesta5c1daef46c0
httplib2@0.22.0
0.32.0

Open the chart page →

1,965
games-on-whalesgeek-cookbookVerified publisher1.8.21 of 7See more

games-on-whales geek-cookbook 1.8.2

1 of the 7 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/xorg:1.0.0305b3327ebba
httplib2@0.18.1
0.32.0

Open the chart page →

35,305
huehue1.0.31 of 3See more

hue hue 1.0.3

1 of the 3 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
gethue/hue:latest7d5c1b9f8a79
httplib2@0.31.2
0.32.0

Open the chart page →

12,397
difykubeblocksVerified publisher0.5.11 of 5See more

dify kubeblocks 0.5.1

1 of the 5 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
langgenius/dify-api:0.6.11fca918260dd6
httplib2@0.22.0
0.32.0

Open the chart page →

20,403
litellmlitellm-helm0.2.01 of 1See more

litellm litellm-helm 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/berriai/litellm-database:litellm_stable_release_branch-v1.75.5-stableab63d26a8a2c
httplib2@0.22.0
0.32.0

Open the chart page →

4,292
mlflow-controllermlflow-deployment-controller0.1.82 of 2See more

mlflow-controller mlflow-deployment-controller 0.1.8

2 of the 2 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
tachyongroup/mlflow-deployment-controller:mlflow-controller-0.1.87e79b9000856
httplib2@0.21.0
0.32.0
tachyongroup/mlflow-deployment-controller-ui:mlflow-controller-0.1.8f4f7fabe1037
httplib2@0.21.0
0.32.0

Open the chart page →

8,957
prowlerprowler-appVerified publisher0.0.91 of 5See more

prowler prowler-app 0.0.9

1 of the 5 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
prowlercloud/prowler-api:5.31.14f252d579be2
httplib2@0.31.2
0.32.0

Open the chart page →

8,158
phpqonstruktVerified publisher0.2.01 of 1See more

php qonstrukt 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
qonstrukt/php:8.4-v8-apache089af7925aa1
httplib2@0.20.4
0.32.0

Open the chart page →

23,964
sentry-k8ssentry-k8sVerified publisher1.4.11 of 11See more

sentry-k8s sentry-k8s 1.4.1

1 of the 11 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/getsentry/snuba:26.7.210f8d164109b
httplib2@0.22.0
0.32.0

Open the chart page →

16,449
alertasomeblackmagic0.2.31 of 2See more

alerta someblackmagic 0.2.3

1 of the 2 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
alerta/alerta-web:8.5.04786b9eaa606
httplib2@0.20.2
0.32.0

Open the chart page →

3,162
browserlessalekcVerified publisher1.2.71 of 1See more

browserless alekc 1.2.7

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/browserless/chrome:v2.56.7d600eac6283f
httplib2@0.20.4
0.32.0

Open the chart page →

2,078
games-on-whalesangelnu2.0.01 of 7See more

games-on-whales angelnu 2.0.0

1 of the 7 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/games-on-whales/xorg:1.0.0305b3327ebba
httplib2@0.18.1
0.32.0

Open the chart page →

42,126
ddosifyanteonVerified publisher1.7.51 of 13See more

ddosify anteon 1.7.5

1 of the 13 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ddosify/selfhosted_backend:2.6.11ac323d52bfb4
httplib2@0.22.0
0.32.0

Open the chart page →

25,669
pgadminappscodeVerified publisher2026.3.301 of 1See more

pgadmin appscode 2026.3.30

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
dpage/pgadmin4:9.11.050700ac17936
httplib2@0.31.0
0.32.0

Open the chart page →

1,565
sickchillbryanalves0.3.01 of 1See more

sickchill bryanalves 0.3.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
linuxserver/sickchill:v2020.08.07-1-ls40e48b479c1891
httplib2@0.18.1
0.32.0

Open the chart page →

2,504
supersetcloudnativeapp1.1.61 of 1See more

superset cloudnativeapp 1.1.6

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
amancevice/superset:0.28.1c8c04bfe3d66
httplib2@0.12.1
0.32.0

Open the chart page →

5,060
cloudlaunchcloudve0.6.01 of 5See more

cloudlaunch cloudve 0.6.0

1 of the 5 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
httplib2@0.20.2
0.32.0

Open the chart page →

12,457
cloudlaunch-servercloudve0.2.01 of 5See more

cloudlaunch-server cloudve 0.2.0

1 of the 5 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
httplib2@0.20.2
0.32.0

Open the chart page →

12,131
cloudlaunchservercloudve0.6.01 of 4See more

cloudlaunchserver cloudve 0.6.0

1 of the 4 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
cloudve/cloudlaunch-server:latest4a3d7fae90bb
httplib2@0.20.2
0.32.0

Open the chart page →

11,592
galaxykubemancloudve2.10.11 of 7See more

galaxykubeman cloudve 2.10.1

1 of the 7 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
galaxy/cloudman-server:lateste5c265fe9fcd
httplib2@0.20.4
0.32.0

Open the chart page →

16,069
galaxy-stablecloudve2.0.02 of 5See more

galaxy-stable cloudve 2.0.0

2 of the 5 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
galaxy/galaxy-init:v18.010267bad550e6
httplib2@0.8
python-httplib2@0.8-2build1
0.32.0
no fix listed
galaxy/galaxy-stable:v18.018e577a626dfd
httplib2@0.8
python-httplib2@0.8-2build1
0.32.0
no fix listed

Open the chart page →

70,895
authentikcluster-deploy0.2.01 of 1See more

authentik cluster-deploy 0.2.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/goauthentik/server:2026.5.6ed120caf710c
httplib2@0.31.2
0.32.0

Open the chart page →

2,481
opencloudcommunity-opencloud3.0.01 of 11See more

opencloud community-opencloud 3.0.0

1 of the 11 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
apache/tika:latest-full80072bb73dd3
httplib2@0.22.0
0.32.0

Open the chart page →

3,773
csghubcsghubVerified publisher2.4.31 of 34See more

csghub csghub 2.4.3

1 of the 34 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
opencsghq/agenticflow:ee-v0.6-52f03fead54db
httplib2@0.22.0
0.32.0

Open the chart page →

58,897
home-assistantdamounVerified publisher1.1.01 of 1See more

home-assistant damoun 1.1.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
ghcr.io/home-assistant/home-assistant:2023.11.3feffc0b8227d
httplib2@0.20.4
0.32.0

Open the chart page →

6,179
redashdasmeta0.1.01 of 1See more

redash dasmeta 0.1.0

1 of the 1 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
redash/redash:26.3.0c5c9148f5c38
httplib2@0.19.0
0.32.0

Open the chart page →

5,062
difydify1.0.01 of 4See more

dify dify 1.0.0

1 of the 4 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
langgenius/dify-api:1.0.0066035f93856
httplib2@0.22.0
0.32.0

Open the chart page →

19,224
codecovdoubanVerified publisher0.2.42 of 8See more

codecov douban 0.2.4

2 of the 8 container images this version deploys carry CVE-2026-59939.

Container imageDigestPackageFixed in
codecov/self-hosted-api:24.4.10475cb1c3136
httplib2@0.20.2
0.32.0
codecov/self-hosted-worker:24.4.1837f546b479b
httplib2@0.19.0
0.32.0

Open the chart page →

24,917

Container images carrying it

103 by charts deploying them

A fixed version is listed for 2 of the 2 affected packages.

Container imageDigestPackageFixed inUsed by
ghcr.io/openrelik/openrelik-worker-extraction:latestec9fc5864cd5
httplib2@0.20.4
0.32.0
1
ghcr.io/openrelik/openrelik-worker-plaso:latest75537ea8c851
httplib2@0.20.4
0.32.0
1
ghcr.io/openrelik/openrelik-worker-timesketch:latest4cb88b603cdc
httplib2@0.20.4
0.32.0
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.