Unbounded Variable Integer Decoding in HTTP/2 Header Encoding for Python Affects hpack

CVE-2026-59980

What is CVE-2026-59980?

The hpack library, used for HTTP/2 header encoding in Python, is susceptible to an input validation issue where unbounded variable integer decoding can lead to excessive runtime when processing malformed inputs. This vulnerability manifests when the library encounters unsanitized input with long sequences of 0xFF values, causing run-away computation characterized by O(n^2) runtime complexity. A patch has been implemented in version 4.2.0, which fortifies the decoding process by limiting variable integers to a uint32 range. Users are advised to update to this version and sanitize their input to mitigate potential exploitation.

References