hpack
PyPI2 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting hpackpage 1 of 1
- CVE-2016-6581HIGHCVSS 7.5EG 7.5fixed in 2.3.02017-01-10
vulnerable: 1.0.0 ... 2.2.0 (8 versions)
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inser…
- CVE-2026-59980MEDIUMCVSS 6.3EG 6.3fixed in 4.2.02026-09-23
vulnerable: 1.0.0 ... 4.1.0 (12 versions)
hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enou…
Check whether hpack is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for hpack CVEs against the assets you own.
Book a Demo →