CVE-2026-59980: hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
python-hyper/hpackto a version that resolves this vulnerability.Fixed in 4.2.0 - Compensating control
Sanitize input to the hpack decoder for long sequences of 0xFF values to prevent malicious use.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using hpack versions prior to 4.2.0 are affected when they pass large, unsanitized malformed input to the hpack decoder. Input containing long sequences of 0xFF values is specifically identified as maliciously useful.
What does an attacker need to do to trigger the issue?
An attacker needs to cause malformed input to reach the hpack decoder, using sufficiently long variable-integer encodings such as long runs of 0xFF bytes. Processing that input can take O(n^2) time and block further processing.
What can be done before upgrading?
Sanitize input sent to the hpack decoder and reject long sequences of 0xFF values. The available fix in hpack 4.2.0 restricts variable-integer decoding to uint32.