Skip to content
OpenAdvisories

Vendor

python-hyper

4 known vulnerabilities.

Products

h2 2 h11 1 hpack 1
All Critical High Medium Low Exploited only

3 results · Clear filters · Feed

  • Medium 6.3
    CVE-2026-59980

    hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

    hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input…

    python-hyper hpack hpack python-hpack Debian Ubuntu PyPI
  • Medium 5.3
    CVE-2026-71554

    h2: Duplicate Host header could facilitate request smuggling

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP…

    python-hyper h2 python-h2 h2 Debian Ubuntu PyPI
  • Medium 6.9
    CVE-2025-57804

    h2 allows HTTP Request Smuggling due to illegal characters in headers

    h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrad…

    python-hyper h2 python-h2 h2 Debian Ubuntu PyPI