CVE-2026-59980: hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
Users of the python-hyper/hpack library, most commonly used as downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input.
References
- cs.opensource.google/go/x/net/+/master:http2/hpack/hpack.go;l=468;drc=8e2b117aee74f6b86c207a808b0255de45c0a18a
- docs.rs/http2/0.5.19/src/http2/hpack/decoder.rs.html
- github.com/advisories/GHSA-8v8h-hg4w-mvq2
- github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c
- github.com/python-hyper/hpack/releases/tag/v4.2.0
- github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2
- nvd.nist.gov/vuln/detail/CVE-2026-59980
Code Behaviors & Features
Detect and mitigate CVE-2026-59980 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →