python-hyper vulnerabilities

Products

• h2 2
• brotlicffi 1
• h11 1
• hpack 1

Latest python-hyper CVEs

Newest publication first

1. CVE-2026-111497 Out-of-Bounds Write in Google Brotli Decoder

   Published 2026-10-22

   Critical·CVSS 9.2 EPSS 82.6% CISA KEV added 2026-10-27 Exploited in the wild PoC

   A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service,...

2. CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

   Published 2026-09-23

   Medium·CVSS 6.3 EPSS 0.30%

   hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available...

3. CVE-2026-71554 h2: Duplicate Host header could facilitate request smuggling

   Published 2026-08-06

   Medium·CVSS 5.3 EPSS 0.42%

   h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP/2 to HTTP/1.1, the r...

4. CVE-2025-57804 h2 allows HTTP Request Smuggling due to illegal characters in headers

   Published 2025-08-25

   Medium·CVSS 6.9 EPSS 1.9%

   h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrade HTTP/2 requests to...

5. CVE-2025-43859 h11 accepts some malformed Chunked-Encoding bodies

   Published 2025-04-24

   Critical·CVSS 9.1 EPSS 0.59%

   h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in version 0.16.0. Since explo...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.