All vulnerabilities
CVE-2026-59980GHSA-8v8h-hg4w-mvq2PYSEC-2026-4053

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

python-hyper hpackpipRuntimes & languages
Open in ThreatlineRecord JSON
CVSS
6.3Medium
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.30%Chance of exploitation activity in the next 30 days, higher than 21% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in4.2.0Fixed versionGitHub
Published23 Sep 2026Updated 1 Oct 2026CVE List

What fixes it

  • 4.2.0hpack, pipGitHub
  • 4.2.0hpack, PyPIOSVpip install "hpack>=4.2.0"

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

Impact

Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input.

Patches

A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation.

Workarounds

Sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.

Text from GitHub Advisory Database

Affected versions 15

  • hpack, pip<= 4.1.0GitHub
  • hpackaffected: < 4.2.0CVE List
  • hpack, PyPIfrom first release, fixed in 4.2.0OSV
  • hpack, PyPI1.0.0OSV
  • hpack, PyPI1.0.1OSV
  • hpack, PyPI1.1.0OSV
  • hpack, PyPI2.0.0OSV
  • hpack, PyPI2.0.1OSV
  • hpack, PyPI2.1.0OSV
  • hpack, PyPI2.1.1OSV
  • hpack, PyPI2.2.0OSV
  • hpack, PyPI2.3.0OSV
  • hpack, PyPI3.0.0OSV
  • hpack, PyPI4.0.0OSV
  • hpack, PyPI4.1.0OSV

References 7