CVE-2026-59980: hpack Package Unbounded Variable Integer Decoding Vulnerability
Summary
CVE-2026-59980: hpack: Unbounded variable integer decoding can cause run-away computation on malformed input. Affects hpack versions < 4.2.0. Fixed in 4.2.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The hpack package is a Python library that implements HPACK, the header compression format used in HTTP/2. It is commonly utilized as a dependency in the python-hyper/h2 library, which provides HTTP/2 client and server functionalities. The hpack library is designed to efficiently encode and decode HTTP/2 header fields, but it is susceptible to vulnerabilities that can be exploited through malformed input.
Vulnerability Detail
The vulnerability arises from unbounded variable integer decoding within the hpack library. This flaw can lead to excessive computation time when processing malformed input, resulting in a potential denial of service (DoS) scenario. Specifically, the decoding process can exhibit O(n^2) runtime behavior, effectively blocking further processing when faced with sufficiently large and unsanitized input. This can be particularly detrimental in environments where performance and responsiveness are critical.
How To Fix
Latest published version: 4.2.0 as of 22 Oct 2026
pip install --upgrade "hpack==4.2.0"The newest release already contains this fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to sanitize input to the hpack decoder, particularly for long sequences of '0xFF' values. This can help mitigate the risk of exploitation until the package is updated. For example, you can implement input validation in your code as follows:
def sanitize_input(input_data):
if input_data.count(b'\xFF') > threshold:
raise ValueError('Input contains too many 0xFF values')
return input_data
Conclusion
The hpack package has a significant vulnerability (CVE-2026-59980) that can lead to denial of service through unbounded variable integer decoding. Users are strongly encouraged to update to version 4.2.0 or later to mitigate this risk. Until then, input sanitization is a recommended workaround.
See every vulnerability recorded for hpack →
FAQ
CVE-2026-59980 is a vulnerability in the hpack package that allows for unbounded variable integer decoding, potentially leading to denial of service due to excessive computation time.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without requiring any signup.
The CVSS score for this vulnerability is 6.3, indicating a medium severity level that could impact the performance and availability of affected applications.
If an immediate update is not possible, implement input sanitization to filter out potentially malicious input, particularly sequences of '0xFF' values.
More information about the hpack library can be found on its GitHub repository or the official documentation, which details its usage and features.
References
Related vulnerabilities
Recent vulnerabilities recorded for hpack.
