CVE-2016-6580: High severity python priority library vulnerability
A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2016-6580?
CVE-2016-6580 is considered a medium severity vulnerability due to its potential impact on application performance and stability.
How do I fix CVE-2016-6580?
To fix CVE-2016-6580, update the Python priority library to version 1.2.0 or later.
What software is affected by CVE-2016-6580?
CVE-2016-6580 affects all versions of the Python priority library prior to 1.2.0.
Can CVE-2016-6580 be exploited remotely?
Yes, CVE-2016-6580 can potentially be exploited by a malicious peer over the network.
What are the risks of not addressing CVE-2016-6580?
Failing to address CVE-2016-6580 may lead to degraded application performance and possible denial of service.