PyPI/hpack CVE-2016-6581: high 7.5, EPSS 1.83%

HPACK Denial of Service vulnerability (HPACK Bomb)

Action: Upgrade hpack to 2.3.0 or later.

pip install hpack==2.3.0

Affected

Fixed versions

Sources

• osv: GHSA-ffq8-576r-v26g
• https://nvd.nist.gov/vuln/detail/CVE-2016-6581
• https://github.com/advisories/GHSA-ffq8-576r-v26g
• https://github.com/pypa/advisory-database/tree/main/vulns/hpack/PYSEC-2017-87.yaml
• https://github.com/python-hyper/hpack
• https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.html
• https://web.archive.org/web/20200227233559/http://www.securityfocus.com/bid/92315
• http://python-hyper.org/projects/hpack/en/stable/security/CVE-2016-6581.html

CVE-2016-6581 · published 2019-07-05T21:11:05Z · modified 2024-11-30T05:39:01.605415Z · JSON