Python hpack EUVD-2026-85712

Exploitation requires that the target application decode attacker-influenced HTTP/2 HPACK header data using python-hyper/hpack prior to version 4.2.0 - typically an internet-facing or otherwise reachable Python HTTP/2 server or client built on the h2/hyper stack. The specific trigger is a malformed variable-length integer encoded as a long sequence of 0xFF octets, which pre-fix has no upper bound and drives O(n^2) decoding. Limiting factors: the CVSS AT:P attack requirement reflects that the attacker must be able to submit unsanitized header input to the decoder; impact is confined to availability (a single processing path/worker), with no confidentiality or integrity effect. The documented workaround is to sanitize decoder input for long runs of 0xFF values.

This is a genuine but bounded denial-of-service issue, not a high-urgency emergency. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L) and score of 6.3 (Medium) are internally consistent with the description: network-reachable, low complexity, no privileges or user interaction, but only a LOW availability impact and an AT:P attack requirement (the target must be feeding attacker-controlled HPACK header blocks into the decoder). The only impact is availability (VA:L) - there is no confidentiality or integrity exposure - which correctly caps the severity. No EPSS score was supplied, there is no CISA KEV listing, and no weaponized POC is provided; the referenced GitHub artifacts are the security advisory (GHSA-8v8h-hg4w-mvq2) and the fix commit, not exploit code. Signals are therefore consistent rather than conflicting: a real, easily-triggered algorithmic-complexity DoS with modest single-connection impact, meriting routine patching rather than crisis response. Note the 'unbounded' O(n^2) computation means impact scales with input size, so an attacker who can send large malformed header blocks could tie up a worker thread - worth prioritizing for internet-facing HTTP/2 endpoints that pass untrusted input to hpack.

An attacker sends a malformed HTTP/2 HPACK header block containing a long run of 0xFF bytes encoding an unbounded variable-length integer to a Python service that decodes headers with hpack (e.g. via the h2 stack). The decoder enters run-away O(n^2) computation, consuming CPU and blocking further processing of that input. No authentication or user interaction is required; no public exploit code is identified, though the fix commit and a regression test (b'\xff\xff\xff\xff\xff\xff') illustrate the trigger.