CVE-2026-59980: Python hpack HTTP/2 DoS Vulnerability

CVE-2026-59980 Overview

CVE-2026-59980 is a denial-of-service vulnerability in hpack, the HTTP/2 Header Encoding library for Python maintained by the python-hyper project. Versions prior to 4.2.0 perform unbounded variable integer decoding on incoming HPACK-encoded headers. An attacker who submits malformed input containing long sequences of 0xFF bytes can trigger O(n^2) runtime behavior in the decoder. The resulting run-away computation stalls further processing on the affected process. The issue is tracked under [CWE-400: Uncontrolled Resource Consumption].

Critical Impact
Remote, unauthenticated attackers can exhaust CPU resources on HTTP/2 endpoints that use vulnerable hpack versions, blocking legitimate header decoding.

Affected Products

python-hyper/hpack versions prior to 4.2.0
Python HTTP/2 stacks and frameworks depending on vulnerable hpack releases
Applications exposing HTTP/2 endpoints built on the hyper ecosystem

Discovery Timeline

2026-09-23 - CVE-2026-59980 published to the National Vulnerability Database
2026-09-23 - Last updated in NVD database

Technical Details for CVE-2026-59980

Vulnerability Analysis

HPACK encodes integer values using a variable-length prefix scheme defined in RFC 7541. When a value exceeds the initial prefix, additional continuation octets encode the remainder in 7-bit groups, with the high bit signaling continuation. The vulnerable hpack decoder places no upper bound on the number of continuation octets it will consume.

An attacker can craft an HPACK integer that consists of a long sequence of 0xFF continuation bytes. Each additional byte extends the accumulator and forces the decoding loop to keep multiplying and adding, producing quadratic runtime relative to input length. Because HPACK decoding is performed synchronously per incoming header block, a single malicious frame can pin a worker on CPU work and stall the connection or process.

Root Cause

The decoder lacked a maximum length constraint on variable-length integer decoding. Without a ceiling on the number of octets consumed, arbitrarily large accumulator values could be constructed. This is a classic algorithmic complexity flaw: the parser trusted attacker-controlled length signals.

Attack Vector

Exploitation requires only the ability to send HTTP/2 traffic to a service using a vulnerable hpack version. No authentication or user interaction is required. The malicious payload is a HEADERS or CONTINUATION frame containing an HPACK integer padded with 0xFF continuation bytes. On receipt, the server's decoder enters the quadratic path and blocks further HTTP/2 processing on that worker.

python

# Fix from python-hyper/hpack commit 8cfb02c547740e16dbfe7aba77bad84b297cec2c
INDEX_NEVER = b"\\x10"
INDEX_INCREMENTAL = b"\\x40"

VARINT_MAX_LENGTH = 5  # octets, enough for encoding prefix + uint32

# Precompute 2^i for 1-8 for use in prefix calcs.
# Zero index is not used but there to save a subtraction
# as prefix numbers are not zero indexed.

Source: python-hyper/hpack commit 8cfb02c

Detection Methods for CVE-2026-59980

Indicators of Compromise

HTTP/2 HEADERS or CONTINUATION frames containing unusually long runs of 0xFF bytes within variable-length integer fields.
Python worker processes exhibiting sustained high CPU while handling a single HTTP/2 connection.
Client connections timing out or stalling immediately after sending a HEADERS frame.

Detection Strategies

Inspect HTTP/2 traffic at the proxy or WAF layer for HEADERS frames whose HPACK-encoded integer regions exceed 5 octets.
Instrument application-level metrics to alert on decoder call durations that exceed a low millisecond threshold.
Audit installed dependencies for hpack versions below 4.2.0 using tooling such as pip list or software composition analysis.

Monitoring Recommendations

Track per-connection CPU time on HTTP/2 listeners and flag outliers correlated with small frame counts.
Log and rate-limit clients producing malformed HTTP/2 frames or repeated decoder errors.
Forward HTTP/2 error events and process resource metrics to a centralized analytics pipeline for anomaly review.

How to Mitigate CVE-2026-59980

Immediate Actions Required

Upgrade hpack to version 4.2.0 or later across all Python services that terminate or proxy HTTP/2.
Rebuild and redeploy container images and virtual environments that pin transitive dependencies on vulnerable hpack releases.
Restart affected services after upgrade to ensure the patched decoder is loaded.

Patch Information

The fix is available in python-hyper/hpack v4.2.0. The patch introduces a VARINT_MAX_LENGTH = 5 constant, restricting variable integer decoding to uint32 and preventing run-away computation. See the GitHub Security Advisory GHSA-8v8h-hg4w-mvq2 and the upstream commit for reference.

Workarounds

Sanitize input to the hpack decoder by rejecting header blocks containing long sequences of 0xFF bytes before they reach the parser.
Terminate HTTP/2 at a front-end proxy that enforces strict HPACK integer length limits.
Apply request-processing timeouts on HTTP/2 worker threads to bound CPU spent decoding a single frame.

bash

# Upgrade hpack to the patched release
pip install --upgrade 'hpack>=4.2.0'

# Verify the installed version
python -c "import hpack; print(hpack.__version__)"