hpax EUVD-2026-41861

Exploitation requires only that the target parses attacker-supplied HTTP/2 header blocks through hpax's 'Elixir.HPAX':decode/2 path using a version between 0.1.1 and 1.0.3 - i.e. any Elixir service (or client processing attacker-influenced responses) that speaks HTTP/2 via a vulnerable hpax. The crafted input is a valid HPACK variable-length integer with an extended sequence of continuation octets and no terminating size limit. Per CVSS 4.0 (AV:N/AC:L/AT:N/PR:N/UI:N) there is no authentication, no user interaction, and no special attack requirement; it works against default configurations. The primary limiting factors are that the service must actually expose an HTTP/2 endpoint and be running an unpatched hpax version, and that impact is confined to availability (CPU/memory exhaustion) - no code execution or data access is possible.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H, score 8.7) is internally consistent with the description: network-reachable, low complexity, no authentication, no user interaction, and impact limited to availability - there is no confidentiality or integrity exposure. Despite the input's 'RCE' tag, this is unambiguously a denial-of-service issue, not remote code execution; the tag is misleading and should be disregarded. No EPSS score, KEV listing, SSVC decision, or POC was provided, so exploitation likelihood must be inferred: the attack is trivial to construct (a hand-crafted HPACK integer, no valid session state or credentials needed) and highly automatable, which argues for real, near-term risk once details are public. The main factors bounding severity are that impact is confined to resource exhaustion (recoverable, no data loss) and that reach depends on the affected service actually terminating HTTP/2 and using a vulnerable hpax version. Overall this is a genuine patch-soon priority for exposed Elixir HTTP/2 endpoints rather than a high-CVSS-but-theoretical issue, but not a drop-everything emergency absent evidence of active exploitation.

An attacker points a script at a public HTTPS service that terminates HTTP/2 on a vulnerable hpax version and opens a connection, requiring no credentials or user interaction. They send a single small header block whose HPACK integer carries a long run of continuation octets, forcing the decoder into ~O(N²) bignum arithmetic; repeating this across connections pins server CPU and starves legitimate requests. No public POC is identified at time of analysis, but the amplification is straightforward to reproduce from the advisory.