hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

Impact Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library an HTTP/2 client and server implementation. Unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blockin...

CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

DEBIAN-CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

UBUNTU-CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling via the decodeinteger function in src/hpack/hpack.py, where an attacker can send an HPACK-encoded integer with an unbounded number of continuation octets, causing run-away computation...

CVE-2026-59980

A flaw was found in hpack, an HTTP/2 Header Encoding for Python. Unbounded variable integer decoding can lead to excessive computation when processing specially crafted, malformed input. A remote attacker could exploit this vulnerability to cause a denial of service by effectively blocking furthe...

CVE-2026-59980

The python-hyper/hpack library, often used as a dependency for the python-hyper/h2 HTTP/2 implementation, is vulnerable to run-away computation due to unbounded variable integer decoding . Malformed input can trigger an O(n^2) runtime, potentially blocking further processing. A fix is available i...

CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-59980

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-77762 Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from...

CVE-2026-77762 Apache Tomcat: Stale HPACK emitter injects trailers into recycled pooled Request

Concurrent Execution using Shared Resource with Improper Synchronization 'Race Condition' vulnerability in Apache Tomcat allows an attacker to inject trailer fields into another HTTP/2 request. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.25, from 10.1.0-M1 through 10.1.59, from...

CVE-2026-59980: Uncontrolled Resource Consumption

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to On^2 runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpa...

CVE-2026-73550

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

EUVD-2026-84111

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...

CVE-2026-73550

Envoy (open-source edge/service proxy) is vulnerable to an HTTP/2 memory-exhaustion flaw. When a duplicate Host header is present alongside :authority , Envoy copies the decoded value before discarding it, but the discarded copy bypasses saveHeader and is not charged against request-header size o...

CVE-2026-73550 Envoy: HTTP/2 Discarded Host Header 200 GB Header-Copy OOM in Envoy

Envoy is an open source edge and service proxy designed for cloud-native applications. Prior to 1.36.10, 1.37.6, 1.38.4, and 1.39.1, Envoy copies every decoded HTTP/2 Host header value before discarding it when :authority is already present. The discarded value bypasses saveHeader, so its bytes a...