Description
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-hpack | 2.3.0-1 | — |
| Debian 13 | python-hpack | 2.3.0-1 | — |
| Debian 12 | python-hpack | 2.3.0-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | python-hpack | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-hpack | 4.0.0-2.7 | openSUSE-SU-2026:11556-1, openSUSE-SU-2024:14140-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | hpack | >= 1.0.0, < 2.3.0 | 2.3.0 | GHSA-ffq8-576r-v26g |
| PyPI | hpack | < 2.3.0 | 2.3.0 | PYSEC-2017-87 |
Advisories 2
- openSUSE-SU-2026:11556-1 python313-hpack-4.2.0-1.1 on GA media SUSE / openSUSE Security Updates · Aug 21, 2026
- openSUSE-SU-2024:14140-1 python310-hpack-4.0.0-2.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026