Every CVE Search/ Get API key

CVE-2026-59980

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

6.3 MediumFix available

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
Low

Exploit likelihood

0.30%Unchanged since Sep 24, 2026
90%50%10%1%

What each source reports

CVE List Score used 6.3

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
CVE-2026-59980
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2026-85712 6.3

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
EUVD-2026-85712
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
GitHub AdvisoriesGHSA-8v8h-hg4w-mvq2 6.3

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

Impact

Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input.

Patches

A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation.

Workarounds

Sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
GHSA-8v8h-hg4w-mvq2
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400
Updated
2026-11-02
NVD 6.3

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
CVE-2026-59980
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness
CWE-400
Updated
2026-11-02
OSV 6.3

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
CVE-2026-59980
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2026-59980 6.3

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
DEBIAN-CVE-2026-59980
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated
2026-11-02
Show 13 moreShow less
OSVGHSA-8v8h-hg4w-mvq2 6.3

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

Impact

Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input.

Patches

A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation.

Workarounds

Sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
GHSA-8v8h-hg4w-mvq2
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Weakness
CWE-400
Updated
2026-11-02
OSVOESA-2026-4239 6.3

python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from nghttp2.

Security Fix(es):

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.(CVE-2026-59980)

Record
OESA-2026-4239
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4240 6.3

python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from nghttp2.

Security Fix(es):

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.(CVE-2026-59980)

Record
OESA-2026-4240
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4241 6.3

python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from nghttp2.

Security Fix(es):

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.(CVE-2026-59980)

Record
OESA-2026-4241
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVOESA-2026-4242 6.3

python-hpack security update

hpack provides a simple Python interface to the HPACK compression algorithm,used to compress HTTP headers in HTTP/2.Used by some of the most populer HTTP/2 implementations in Python,HPACK offers a great Python interface as well as optional upgrade to optimised C-based compression routines from nghttp2.

Security Fix(es):

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.(CVE-2026-59980)

Record
OESA-2026-4242
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVPYSEC-2026-4053 6.3

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

Impact

Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input.

Patches

A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation.

Workarounds

Sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
PYSEC-2026-4053
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVUBUNTU-CVE-2026-59980 6.3

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Record
UBUNTU-CVE-2026-59980
CVSS 4.0
6.3 MediumCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
Updated
2026-11-02
OSVMGASA-2026-0349 No score

Updated python-hpack packages fix a security vulnerability

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix python-hyper/hpack v4.2.0 restricts variable integer decoding to uint32 to prevent run-away computation.

Record
MGASA-2026-0349
Updated
2026-11-02
OSVopenSUSE-SU-2026:11556-1 No score

python313-hpack-4.2.0-1.1 on GA media

These are all security issues fixed in the python313-hpack-4.2.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2026:11556-1
Updated
2026-11-02
OSVopenSUSE-SU-2026:22070-1 No score

Security update for python-hpack

This update for python-hpack fixes the following issue:

  • CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).
Record
openSUSE-SU-2026:22070-1
Updated
2026-11-02
OSVSUSE-SU-2026:24216-1 No score

Security update for python-hpack

This update for python-hpack fixes the following issue:

  • CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).
Record
SUSE-SU-2026:24216-1
Updated
2026-11-02
OSVSUSE-SU-2026:4593-1 No score

Security update for python-hpack

This update for python-hpack fixes the following issue:

  • CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).
Record
SUSE-SU-2026:4593-1
Updated
2026-11-02
OSVSUSE-SU-2026:4832-1 No score

Security update for python-hpack

This update for python-hpack fixes the following issue:

  • CVE-2026-59980: unbounded variable integer decoding can cause run-away computation on malformed input, leading to quadratic runtime (bsc#1283035).
Record
SUSE-SU-2026:4832-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
hpack
PyPI
 through 4.1.0
4.2.0
python-hpack
Debian:12
 All versions, plus listed versions
4.0.0-24.0.0-34.0.0-4
 None known
python-hpack
Debian:13
 All versions, plus listed versions
4.0.0-34.0.0-4
 None known
python-hpack
Debian:14
 All versions, plus listed versions
4.0.0-34.0.0-4
 None known
hpack
PyPI
 before 4.2.0, plus listed versions
1.0.01.0.11.1.02.0.02.0.1
Show 7 moreShow less
2.1.02.1.12.2.02.3.03.0.04.0.04.1.0
4.2.0
python-hpack
Mageia:10
 before 4.2.0-1.mga10
4.2.0-1.mga10
python-hpack
openEuler:22.03-LTS-SP4
 before 4.0.0-2.oe2203sp4
4.0.0-2.oe2203sp4
python-hpack
openEuler:24.03-LTS-SP1
 before 4.0.0-3.oe2403sp1
4.0.0-3.oe2403sp1
python-hpack
openEuler:24.03-LTS-SP3
 before 4.0.0-3.oe2403sp3
4.0.0-3.oe2403sp3
python-hpack
openEuler:24.03-LTS-SP4
 before 4.0.0-3.oe2403sp4
4.0.0-3.oe2403sp4
Show 13 moreShow less
Affected packages
PackageAffectedFixed
python-hpack
SUSE:Linux Enterprise Server 16.0
 before 4.1.0-160000.3.1
4.1.0-160000.3.1
python-hpack
SUSE:Linux Enterprise Server for SAP applications 16.0
 before 4.1.0-160000.3.1
4.1.0-160000.3.1
python-hpack
SUSE:Linux Enterprise Module for Server Applications 15 SP7
 before 3.0.0-150200.3.5.1
3.0.0-150200.3.5.1
python-hpack
SUSE:Linux Enterprise Module for Python 3 15 SP7
 before 4.0.0-150400.8.6.1
4.0.0-150400.8.6.1
python-hpack
Ubuntu:16.04:LTS
 All versions, plus listed versions
1.1.0-12.0.1-12.1.0-1
 None known
python-hpack
Ubuntu:18.04:LTS
 All versions, plus listed versions
3.0.0-13.0.0-2
 None known
python-hpack
Ubuntu:20.04:LTS
 All versions, plus listed versions
3.0.0-33.0.0-4
 None known
python-hpack
Ubuntu:22.04:LTS
 All versions, plus listed versions
4.0.0-2
 None known
python-hpack
Ubuntu:24.04:LTS
 All versions, plus listed versions
4.0.0-2
 None known
python-hpack
Ubuntu:26.10
 All versions, plus listed versions
4.0.0-34.0.0-4
 None known
python-hpack
Ubuntu:26.04:LTS
 All versions, plus listed versions
4.0.0-3
 None known
python-hpack
openSUSE:Tumbleweed
From an advisory covering 2 CVEs
 before 4.2.0-1.1
4.2.0-1.1
python-hpack
openSUSE:Leap 16.0
 before 4.1.0-160000.3.1
4.1.0-160000.3.1

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-59980 is a medium vulnerability (CVSS 6.3) in Python-hyper Hpack, published August 19, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.30%, the 23rd percentile. Fixed in hpack 4.2.0.

References

Show 19 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open