CVE-2026-59980: Uncontrolled Resource Consumption in python-hyper/hpack

Vulnerability ID: CVE-2026-59980
CVSS Score: 6.3
Published: 2026-09-24

CVE-2026-59980 is a CPU exhaustion vulnerability in python-hyper/hpack, where an unauthenticated remote attacker can trigger an infinite loop or high computational complexity overhead by sending a crafted HTTP/2 stream containing excessive variable-length integer continuation octets.

TL;DR

Unbounded variable-length integer decoding in the python-hyper/hpack library enables unauthenticated remote attackers to trigger 100% CPU exhaustion and Denial of Service via malformed HTTP/2 frame headers.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-400
• Attack Vector: Network
• CVSS v4.0 Score: 6.3
• EPSS Score: 0.00301 (20.30% percentile)
• Impact: Denial of Service (CPU Exhaustion)
• Exploit Status: Proof of Concept
• CISA KEV Status: Not Listed

Affected Systems

• python-hyper/hpack
• hpack: >= 1.0.0, < 4.2.0 (Fixed in: 4.2.0)

Code Analysis

Commit: 8cfb02c

Add VARINT_MAX_LENGTH limit in decode_integer to prevent infinite loop / CPU exhaustion from un-terminated or excessively long variable length integer streams.

Mitigation Strategies

• Upgrade python-hyper/hpack to version 4.2.0 or higher.
• Deploy Nginx, HAProxy, or Cloudflare as a reverse proxy/WAF to terminate and validate HTTP/2 frames.
• Implement network-level rate limits on HTTP/2 stream headers.

Remediation Steps:

1. Identify the environment dependency of python-hyper/hpack by running 'pip show hpack'.
2. Update the dependency using 'pip install --upgrade hpack' or specifying 'hpack>=4.2.0' in the requirements file.
3. Restart the application server (e.g., Gunicorn, Uvicorn, Hypercorn) to apply the updated library.
4. Conduct functional tests of HTTP/2 headers to ensure compatibility.

References

• GitHub Security Advisory GHSA-8v8h-hg4w-mvq2
• Official Patch Commit
• hpack v4.2.0 Release Notes
• CVE-2026-59980 Registry Entry

Read the full report for CVE-2026-59980 on our website for more details including interactive diagrams and full exploit analysis.