CVE-2026-59980

MediumCVSS 6.3/10Last modified Sep 30, 2026

Description

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.

Metrics

CVSS 4.0 6.3/10

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-400

Affected software

No affected versions have been published.

Timeline

Published: Sep 23, 2026
Last modified: Sep 30, 2026
NVD status: Deferred

Related CVEs from 2026

CVE-2026-599817.1OpenEXR is the reference implementation and specification for the EXR image file format, widely used in the motion picture industry. In vers CVE-2026-599827.1OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599835.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599845.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599855.5OpenEXR is the reference implementation and specification for the EXR image format, widely used in the motion picture industry. OpenEXR vers CVE-2026-599899.2Phalcon is a high-performance, full-stack PHP framework. In 5.15.0 and earlier, resolveFilter in phalcon/Mvc/View/Engine/Volt/Compiler.zep b CVE-2026-59996.3A vulnerability has been found in JeecgBoot up to 3.9.1. This impacts an unknown function of the component SysAnnouncementController. Such m CVE-2026-599907.5Jawn is an open source JSON parser. Prior to 1.7.0, Jawn parse methods accept arbitrarily deep JSON array and object nesting without a depth CVE-2026-599917.5psd-tools is a Python package for working with Adobe Photoshop PSD files. Prior to 1.17.4, PSDImage.composite() and PSDImage.numpy() allocat CVE-2026-599925.4Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-CVE-2026-599944.3EspoCRM is an open source customer relationship management application. Prior to 9.3.9, an unauthenticated remote attacker can send an email CVE-2026-599955.4sftp in OpenSSH before 10.4 does not properly constrain the location of downloaded files when "sftp server:/path ." is used with an attacker