DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

CVE-2026-59980: CVE-2026-59980: Uncontrolled Resource Consumption in python-hyper/hpack

#security #cve #cybersecurity

CVE-2026-59980: Uncontrolled Resource Consumption in python-hyper/hpack

Vulnerability ID: CVE-2026-59980
CVSS Score: 6.3
Published: 2026-09-24

CVE-2026-59980 is a CPU exhaustion vulnerability in python-hyper/hpack, where an unauthenticated remote attacker can trigger an infinite loop or high computational complexity overhead by sending a crafted HTTP/2 stream containing excessive variable-length integer continuation octets.

TL;DR

Unbounded variable-length integer decoding in the python-hyper/hpack library enables unauthenticated remote attackers to trigger 100% CPU exhaustion and Denial of Service via malformed HTTP/2 frame headers.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-400
  • Attack Vector: Network
  • CVSS v4.0 Score: 6.3
  • EPSS Score: 0.00301 (20.30% percentile)
  • Impact: Denial of Service (CPU Exhaustion)
  • Exploit Status: Proof of Concept
  • CISA KEV Status: Not Listed

Affected Systems

  • python-hyper/hpack
  • hpack: >= 1.0.0, < 4.2.0 (Fixed in: 4.2.0)

Code Analysis

Commit: 8cfb02c

Add VARINT_MAX_LENGTH limit in decode_integer to prevent infinite loop / CPU exhaustion from un-terminated or excessively long variable length integer streams.

Mitigation Strategies

  • Upgrade python-hyper/hpack to version 4.2.0 or higher.
  • Deploy Nginx, HAProxy, or Cloudflare as a reverse proxy/WAF to terminate and validate HTTP/2 frames.
  • Implement network-level rate limits on HTTP/2 stream headers.

Remediation Steps:

  1. Identify the environment dependency of python-hyper/hpack by running 'pip show hpack'.
  2. Update the dependency using 'pip install --upgrade hpack' or specifying 'hpack>=4.2.0' in the requirements file.
  3. Restart the application server (e.g., Gunicorn, Uvicorn, Hypercorn) to apply the updated library.
  4. Conduct functional tests of HTTP/2 headers to ensure compatibility.

References

Read the full report for CVE-2026-59980 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)