cyfenced.com →

[ CVE-2026-59980 · Published 23 Sep 2026 ]

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

CVSS 6.3 EPSS <1%Fix available

[ Description ]Official description

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.

[ Fixes ]Fixes and patches

  • hpack 4.2.0Fixed version · GitHub Advisories · pip package hpack: upgrade to 4.2.0 or later (affected <= 4.1.0)

[ Packages ]Affected open-source packages

[ References ]References