Hpack
Monthly
Denial of service in python-hyper/hpack prior to 4.2.0 allows unauthenticated remote attackers to force run-away computation by supplying malformed HTTP/2 header input containing a variable-length integer encoded as a long run of 0xFF octets; the pre-fix decoder imposes no upper bound on the integer length, producing O(n^2) decoding work that effectively blocks the processing path. The library is a core HPACK header-compression dependency of Python HTTP/2 stacks (h2/hyper), so any internet-facing or otherwise reachable Python HTTP/2 server or client that decodes attacker-influenced headers is exposed, though impact is limited to availability of the affected worker with no confidentiality or integrity effect. No KEV entry or public exploit code was identified at time of analysis, and risk is bounded: the vendor-released fix in hpack 4.2.0 caps variable integer decoding to uint32, and a documented input-sanitization workaround exists.
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.
Denial of service in python-hyper/hpack prior to 4.2.0 allows unauthenticated remote attackers to force run-away computation by supplying malformed HTTP/2 header input containing a variable-length integer encoded as a long run of 0xFF octets; the pre-fix decoder imposes no upper bound on the integer length, producing O(n^2) decoding work that effectively blocks the processing path. The library is a core HPACK header-compression dependency of Python HTTP/2 stacks (h2/hyper), so any internet-facing or otherwise reachable Python HTTP/2 server or client that decodes attacker-influenced headers is exposed, though impact is limited to availability of the affected worker with no confidentiality or integrity effect. No KEV entry or public exploit code was identified at time of analysis, and risk is bounded: the vendor-released fix in hpack 4.2.0 caps variable integer decoding to uint32, and a documented input-sanitization workaround exists.
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.