A HTTP/2 implementation built using any version of the Python HPACK library between…
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-399 and the CVSS impact.
Summary
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | hpack (PyPI) | 1.0.0 to before 2.3.0 | 2.3.0 | Patch available | GHSA-ffq8-576r-v26g |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- hpack (PyPI) Vendor— Affected 1.0.0 to before 2.3.0 Fixed in 2.3.0 Patch available GHSA-ffq8-576r-v26g
CPE configurations NVD · 7
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:hpack:1.0:*:*:*:*:*:*:* | 1.0 | Vulnerable | python-pillow |
| cpe:2.3:a:python:hpack:2.0:*:*:*:*:*:*:* | 2.0 | Vulnerable | python-pillow |
| cpe:2.3:a:python:hpack:2.0.1:*:*:*:*:*:*:* | 2.0.1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:hpack:2.1.1:*:*:*:*:*:*:* | 2.1.1 | Vulnerable | python-pillow |
| cpe:2.3:a:python:hpack:2.2:*:*:*:*:*:*:* | 2.2 | Vulnerable | python-pillow |
| cpe:2.3:a:python:hyper:0.4:*:*:*:*:*:*:* | 0.4 | Vulnerable | python-pillow |
| cpe:2.3:a:python:hyper:0.6:*:*:*:*:*:*:* | 0.6 | Vulnerable | python-pillow |
- cpe:2.3:a:python:hpack:1.0:*:*:*:*:*:*:* Versions 1.0 Vulnerable ·python-pillow
- cpe:2.3:a:python:hpack:2.0:*:*:*:*:*:*:* Versions 2.0 Vulnerable ·python-pillow
- cpe:2.3:a:python:hpack:2.0.1:*:*:*:*:*:*:* Versions 2.0.1 Vulnerable ·python-pillow
- cpe:2.3:a:python:hpack:2.1.1:*:*:*:*:*:*:* Versions 2.1.1 Vulnerable ·python-pillow
- cpe:2.3:a:python:hpack:2.2:*:*:*:*:*:*:* Versions 2.2 Vulnerable ·python-pillow
- cpe:2.3:a:python:hyper:0.4:*:*:*:*:*:*:* Versions 0.4 Vulnerable ·python-pillow
- cpe:2.3:a:python:hyper:0.6:*:*:*:*:*:*:* Versions 0.6 Vulnerable ·python-pillow
Remediation
- Fix · GHSA-ffq8-576r-v26g hpack (PyPI) Fixed in 2.3.0 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2016-6581
- 2026-10-03 Alias added: GHSA-ffq8-576r-v26g
References
Advisory 3
Sources
- CVE-2016-6581 · CVE Program
- CVE-2016-6581 · NVD
- FIRST EPSS
- GHSA-ffq8-576r-v26g · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences