Executive brief
hpack is a library used by HTTP/2 implementations to compress HTTP headers. An attacker can send malformed HTTP/2 header data containing long sequences of specific byte values that trigger inefficient decoding logic, causing the server to consume excessive CPU and effectively freeze while processing the request. This can be exploited remotely without authentication to deny service to legitimate users.
Technical details
The vulnerability is an uncontrolled resource consumption issue (CWE-400) in the variable integer decoding logic of hpack. The decoder fails to bound the maximum value of decoded integers, allowing malicious input with sequences of 0xFF bytes to trigger O(n²) runtime complexity instead of the expected linear behavior. An attacker can send a crafted HTTP/2 HEADERS frame over the network to any hpack-using HTTP/2 server without privileges or user interaction. The impact is denial of service through CPU exhaustion. A patch is available in hpack version 4.2.0, which restricts variable integer decoding to uint32.
Affected products
- python-hyper hpack <= 4.1.0
Timeline
- 2026-06-23: disclosed
- 2026-06-23: patched: hpack v4.2.0 released
- 2026-09-24: advisory