CVE-2026-59980 hpack: Unbounded variable integer decoding can cause run-away computation on malformed input
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-59980?
CVE-2026-59980 is a medium-severity vulnerability in python-hyper hpack, published on 23 Sep 2026.
Official description
hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix is available in python-hyper/hpack v4.2.0 to restricted variable integer decoding to uint32 to prevent run-away computation. As a workaround, sanitize input to hpack decoder for long sequences of `0xFF` values to prevent malicious use.
Weakness: CWE-400
Which versions are affected by CVE-2026-59980?
3 open source packages ship an affected version, including hpack.
| Package | Affected | Fixed in |
|---|---|---|
hpack PyPI | All versions | 4.2.0 |
hpack PyPI | All versions | 4.2.0 |
hpack PyPI | All versions | 4.2.0 |
Linux distribution packages (5)
python-hpack SUSE:Linux Enterprise Module for Python 3 15 SP7 | All versions | 4.0.0-150400.8.6.1 |
python-hpack SUSE:Linux Enterprise Module for Server Applications 15 SP7 | All versions | 3.0.0-150200.3.5.1 |
python-hpack SUSE:Linux Enterprise Server 16.0 | All versions | 4.1.0-160000.3.1 |
python-hpack SUSE:Linux Enterprise Server for SAP applications 16.0 | All versions | 4.1.0-160000.3.1 |
python-hpack openSUSE:Leap 16.0 | All versions | 4.1.0-160000.3.1 |
How do I fix CVE-2026-59980?
Upgrade hpack to 4.2.0 or later.
Is CVE-2026-59980 being exploited?
There is no known exploitation of CVE-2026-59980 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-WU74095, CLEANSTART-2026-YJ27178, DEBIAN-CVE-2026-59980, ECHO-b10e-5b40-f5bb, GHSA-8v8h-hg4w-mvq2, MGASA-2026-0349 and 12 more.