python-hyper hpack vulnerabilities

Latest python-hyper hpack CVEs

Newest publication first

1. CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

   Published 2026-09-23

   Medium·CVSS 6.3

   hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.