GHSA-8v8h-hg4w-mvq2: Pip/hpack vulnerability
Impact
Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input.
Patches A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation.
Workarounds Sanitize input to hpack decoder for long sequences of 0xFF values to prevent malicious use.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/hpackto a version that resolves this vulnerability.Fixed in 4.2.0 - Upgrade
Upgrade
python-hyper/hpackto a version that resolves this vulnerability.Fixed in 4.2.0 - Compensating control
Sanitize input to the hpack decoder to reject or limit long sequences of 0xFF values.
Event History
Frequently Asked Questions
Which applications are most likely to be exposed?
Applications that use python-hyper/hpack directly or through python-hyper/h2 and pass unsanitized input to the HPACK decoder are the relevant exposure cases. The issue can block further processing when sufficiently large malformed input is decoded.
What does an attacker need to send to trigger the problem?
The decoder must receive malformed input containing long sequences of 0xFF values. The input must be large enough for unbounded variable-integer decoding to cause runaway O(n^2) computation.
What can be done if upgrading is not immediately possible?
Sanitize input before it reaches the hpack decoder and reject long sequences of 0xFF values. This is the documented workaround to prevent malicious use.
What version contains the fix?
The fix is available in python-hyper/hpack version 4.2.0, which restricts variable-integer decoding to uint32.