AIKIDO-2026-721881

TL;DR

The httplib2 HTTP client automatically decompresses response bodies that carry a gzip or deflate Content-Encoding header. Before the fix it decompressed the entire body into memory with no size or amplification limit, so a small compressed response could expand into a very large output. A malicious or compromised server can exploit this with a decompression bomb to exhaust client memory and cause denial of service. The fix wraps decoding in a limiter that enforces a hard output limit, a safe-size threshold, and an output-to-input ratio, raising an error when they are exceeded.