Bug 2539827 (CVE-2026-59980) - CVE-2026-59980 hpack: golang.org/x/net/http2/hpack: hpack: Denial of Service via malformed HTTP/2 header encoding
Summary: CVE-2026-59980 hpack: golang.org/x/net/http2/hpack: hpack: Denial of Service ...
Keywords:
Status: NEW
Alias: CVE-2026-59980
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
low
low
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-23 22:22 UTC by OSIDB Bzimport
Modified: 2026-09-24 12:39 UTC (History)
22 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-23 22:22:31 UTC 
hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.
Note You need to log in before you can comment on or make changes to this bug.