Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.
VOLERION
Volerion Security Research

NOT DEFERRED DATABASE

VULNERABILITIES

CVE-2016-6581 Details

Description

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.

Metrics

CVSS 3.x Severity and Vector Strings:

NIST: [email protected]CVSS-B:7.5 HIGHVector:CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URLSource(s)Tag(s)
https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.html CVEMitigationVendor Advisory
http://www.securityfocus.com/bid/92315 CVEThird Party AdvisoryVDB Entry
https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.html [email protected]MitigationVendor Advisory
http://www.securityfocus.com/bid/92315 [email protected]Third Party AdvisoryVDB Entry

Weakness Enumeration

CWE-IDCWE NameSource
CWE-399Resource Management Errors[email protected]

Affected Products

ProductVersions
python hpack
1.0
2.0
2.0.1
2.1.1
2.2

CPE

  • cpe:2.3:a:python:hpack:1.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:hpack:2.0:*:*:*:*:*:*:*
  • cpe:2.3:a:python:hpack:2.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:hpack:2.1.1:*:*:*:*:*:*:*
  • cpe:2.3:a:python:hpack:2.2:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.
python hyper
0.4
0.6

CPE

  • cpe:2.3:a:python:hyper:0.4:*:*:*:*:*:*:*
  • cpe:2.3:a:python:hyper:0.6:*:*:*:*:*:*:*

Remediation

  • No remediation found in references.

Change History

7 change records found show changes

QUICK INFO

CVE Dictionary Entry:
CVE-2016-6581
NVD Published Date:
Jan 10, 2017
NVD Last Modified:
Jun 17, 2026
Source:
[email protected]
CVE-2016-6581 Details - Not Deferred