https://vulnerability.circl.lu/sightings/feed 2026-09-26T21:27:32.518391+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent sightings. https://vulnerability.circl.lu/sighting/dab04059-61e1-4c3b-b693-1b833334871a/export 2026-09-26T21:27:32.557383+00:00 Automation user https://cve.circl.lu/user/automation {"uuid": "dab04059-61e1-4c3b-b693-1b833334871a", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-59980", "type": "seen", "source": "https://gist.github.com/alon710/256195b8da831d2851e64a796d5d077f", "content": "# CVE-2026-59980: CVE-2026-59980: Uncontrolled Resource Consumption in python-hyper/hpack\n\n> **CVSS Score:** 6.3\n> **Published:** 2026-09-24\n> **Full Report:** https://cvereports.com/reports/CVE-2026-59980\n\n## Summary\nCVE-2026-59980 is a CPU exhaustion vulnerability in python-hyper/hpack, where an unauthenticated remote attacker can trigger an infinite loop or high computational complexity overhead by sending a crafted HTTP/2 stream containing excessive variable-length integer continuation octets.\n\n## TL;DR\nUnbounded variable-length integer decoding in the python-hyper/hpack library enables unauthenticated remote attackers to trigger 100% CPU exhaustion and Denial of Service via malformed HTTP/2 frame headers.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-400\n- **Attack Vector**: Network\n- **CVSS v4.0 Score**: 6.3\n- **EPSS Score**: 0.00301 (20.30% percentile)\n- **Impact**: Denial of Service (CPU Exhaustion)\n- **Exploit Status**: Proof of Concept\n- **CISA KEV Status**: Not Listed\n\n## Affected Systems\n\n- python-hyper/hpack\n- **hpack**: >= 1.0.0, < 4.2.0 (Fixed in: `4.2.0`)\n\n## Mitigation\n\n- Upgrade python-hyper/hpack to version 4.2.0 or higher.\n- Deploy Nginx, HAProxy, or Cloudflare as a reverse proxy/WAF to terminate and validate HTTP/2 frames.\n- Implement network-level rate limits on HTTP/2 stream headers.\n\n**Remediation Steps:**\n1. Identify the environment dependency of python-hyper/hpack by running 'pip show hpack'.\n2. Update the dependency using 'pip install --upgrade hpack' or specifying 'hpack>=4.2.0' in the requirements file.\n3. Restart the application server (e.g., Gunicorn, Uvicorn, Hypercorn) to apply the updated library.\n4. Conduct functional tests of HTTP/2 headers to ensure compatibility.\n\n## References\n\n- [GitHub Security Advisory GHSA-8v8h-hg4w-mvq2](https://github.com/python-hyper/hpack/security/advisories/GHSA-8v8h-hg4w-mvq2)\n- [Official Patch Commit](https://github.com/python-hyper/hpack/commit/8cfb02c547740e16dbfe7aba77bad84b297cec2c)\n- [hpack v4.2.0 Release Notes](https://github.com/python-hyper/hpack/releases/tag/v4.2.0)\n- [CVE-2026-59980 Registry Entry](https://www.cve.org/CVERecord?id=CVE-2026-59980)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/CVE-2026-59980) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-25T08:30:31.000000Z"} 2026-09-25T08:30:31+00:00