CVE-2026-59980: 
Linux Debian 脆弱性の分析と軽減

CVE-2026-59980 is a Denial of Service vulnerability in the hpack HTTP/2 Header Encoding library for Python (python-hyper/hpack). The flaw stems from unbounded variable integer decoding that produces O(n²) runtime complexity when processing malformed input, effectively blocking further processing with sufficiently large unsanitized input. All versions up to and including 4.1.0 are affected; the vulnerability was published on June 23, 2026, and disclosed publicly on September 23, 2026. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.3 (Medium) (GitHub Advisory, Red Hat Bugzilla).

The root cause is uncontrolled resource consumption (CWE-400) and allocation of resources without limits or throttling (CWE-770) in the decode_integer() function within src/hpack/hpack.py. The HPACK RFC 7541 Section 5.1 does not define a maximum size for variable-length integer encoding, and the original implementation had no upper bound on the number of continuation octets it would process. An attacker can craft HTTP/2 HEADERS frames containing long sequences of 0xFF bytes in the variable-length integer fields; each additional 0xFF byte causes the decoder to perform progressively more work, resulting in O(n²) CPU consumption. The fix (commit 8cfb02c) introduces a VARINT_MAX_LENGTH constant of 5 octets (sufficient to encode a uint32 prefix) and raises an HPACKDecodingError if the representation exceeds this limit (GitHub Advisory, Patch Commit).

Successful exploitation causes excessive CPU consumption on the server processing HTTP/2 connections, rendering the application unresponsive and constituting a Denial of Service condition. There is no impact on confidentiality or integrity — only availability is affected. Because hpack is commonly used as a downstream dependency of the python-hyper/h2 HTTP/2 server and client library, any Python application relying on h2 for HTTP/2 support may be indirectly exposed (GitHub Advisory, Red Hat Bugzilla).

No public proof-of-concept exploit code has been identified, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The vulnerability is remotely exploitable with no authentication or user interaction required, lowering the barrier for abuse. The EPSS score is 0.0, reflecting the current absence of observed exploitation activity. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify HTTP/2-enabled services built on Python using the hpack or h2 libraries (e.g., via HTTP/2 fingerprinting tools or banner analysis on target endpoints).
2. Craft malicious HEADERS frame: Construct an HTTP/2 HEADERS frame where one or more header field integer values are encoded as an abnormally long sequence of 0xFF continuation bytes (e.g., \xff\xff\xff\xff\xff\xff... repeated hundreds or thousands of times).
3. Establish HTTP/2 connection: Open a valid HTTP/2 connection to the target server (TLS or cleartext, depending on server configuration).
4. Send malformed frame: Transmit the crafted HEADERS frame to the server. The vulnerable decode_integer() function will enter O(n²) computation as it processes each 0xFF byte without bound.
5. Trigger DoS: With a sufficiently long 0xFF sequence, the server's CPU is saturated processing the single malformed frame, blocking all further HTTP/2 request handling and effectively taking the service offline (GitHub Advisory, Patch Commit).

• Network: Inbound HTTP/2 connections containing HEADERS frames with unusually large payloads; repeated connections from the same source IP sending oversized HEADERS frames.
• Process: Python worker processes consuming near 100% CPU for extended periods without completing requests; process hang or timeout on HTTP/2 request handling threads.
• Logs: Application or web server logs showing HTTP/2 connection timeouts or HPACKDecodingError exceptions (post-patch); absence of completed responses for connections that remain open and CPU-intensive.
• System: Elevated CPU utilization on the host correlated with incoming HTTP/2 traffic spikes, without a corresponding increase in legitimate request throughput.

Upgrade hpack to version 4.2.0 or later, which restricts variable integer decoding to a maximum of 5 octets (uint32 range) and raises an HPACKDecodingError for oversized representations (GitHub Advisory, Patch Commit). As a temporary workaround where immediate upgrade is not possible, sanitize input to the hpack decoder by rejecting or truncating long sequences of 0xFF bytes before they reach the decode_integer() function. Organizations using python-hyper/h2 or other libraries that depend on hpack should audit their dependency trees and update accordingly.

Red Hat tracked the issue via Bugzilla (Bug 2539827) with a low severity/priority rating, and the OpenSUSE security announce list also referenced the advisory (Red Hat Bugzilla). The vulnerability was credited to researcher Hiroki Nishino (GitHub: tawAsh1), who reported the issue to the python-hyper project (Patch Commit). No significant broader media coverage or notable social media discussion has been observed beyond standard vulnerability aggregator postings.