CVE-2026-58226: hpax Unauthenticated Denial-of-Service via Unbounded HPACK Integer Decoding
Summary
CVE-2026-58226: Unauthenticated denial-of-service via unbounded HPACK integer decoding in hpax. Affects hpax across 2 version ranges.
>= 0.1.1, < 1.0.4
>= 56db437a7e2c515e3bdd770ac7947b02cd2390d0, < 1ba4bb2dc91e80089cf89c73970ac3ded76f17eb
Fixed in 1.0.4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
hpax is a library used in the Elixir ecosystem for decoding HPACK, a compression format used in HTTP/2. It allows efficient encoding and decoding of header fields, which is crucial for performance in web applications. However, the library has a vulnerability that can lead to denial-of-service attacks if exploited by an unauthenticated attacker.
Vulnerability Detail
The vulnerability in hpax arises from an inefficient algorithmic complexity in the decoding process of HPACK variable-length integers. The function 'Elixir.HPAX.Types:decode_remaining_integer/3' does not impose an upper limit on the decoded integer value or the number of continuation octets. This can lead to the creation of excessively large integers, resulting in superlinear decoding costs (approximately O(N^2)). An unauthenticated attacker can exploit this by sending a specially crafted HTTP/2 header block, causing significant CPU and memory consumption on the server, leading to denial-of-service conditions.
How To Fix
Minimum fixed version
1.0.4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, you can implement rate limiting on incoming HTTP/2 requests to mitigate the impact of potential denial-of-service attacks while you work on updating the hpax package.
Conclusion
CVE-2026-58226 represents a significant vulnerability in the hpax library that can lead to denial-of-service attacks. It is crucial for developers using this library to update to the patched version to safeguard their applications. Implementing rate limiting can serve as a temporary measure while updates are being made.
See every vulnerability recorded for hpax →
FAQ
CVE-2026-58226 is a vulnerability in the hpax library that allows unauthenticated denial-of-service attacks via unbounded HPACK integer decoding.
If your application uses the hpax library and is exposed to unauthenticated HTTP/2 requests, it may be susceptible to denial-of-service attacks, potentially leading to service outages.
The CVSS score for CVE-2026-58226 is 8.7, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If immediate updates are not possible, consider implementing rate limiting on your HTTP/2 endpoints to reduce the risk of denial-of-service attacks.
