CVE-2026-59980

Received Received - Intake

HPACK Variable Integer Decoding Denial of Service

Publication date: 2026-09-23

Last updated on: 2026-09-23

Assigner: GitHub, Inc.

Description

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-23

Last Modified

2026-09-23

Generated

2026-09-24

AI Q&A

2026-09-24

EPSS Evaluated

N/A

NVD

CVE-2026-59980

Affected Vendors & Products

Vendor	Product	Version / Range
python-hyper	hpack	to 4.2.0 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-400	The product does not properly control the allocation and maintenance of a limited resource.

Attack-Flow Graph

Executive Summary

This vulnerability affects hpack, an HTTP/2 Header Encoding library for Python. It involves unbounded variable integer decoding that can cause excessive computation when processing malformed input, leading to O(n^2) runtime complexity. This effectively blocks further processing with large unsanitized inputs.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual CPU usage spikes when processing HTTP/2 headers. Check for long sequences of 0xFF bytes in network traffic or application logs. Use tools like Wireshark to inspect HTTP/2 frames for malformed headers.

Impact Analysis

The vulnerability can cause denial-of-service by consuming excessive CPU resources when processing crafted input. Systems using affected versions of hpack may become unresponsive or slow down significantly under malicious input.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it relates to HTTP/2 header decoding performance degradation rather than data privacy or security controls.

Mitigation Strategies

Upgrade to python-hyper/hpack v4.2.0 or later. If upgrading is not possible, sanitize input to the hpack decoder by filtering out long sequences of 0xFF values. Monitor CPU usage and network traffic for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-59980. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70