python-hyper vulnerabilities (CVE)

CVE records published for python-hyper, newest first. Follow to get an email when a new one appears.

5 results

9.2Critical

CVE-2026-111497 KEV 18 days ago

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Cloud Connector Configurator; Siemens Common Configurator (CC on IEM); Siemens Common Configurator on Device (CC on Edge)

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS

6.3Medium

CVE-2026-59980 1 month ago

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

python-hyper hpack

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input…

5.3Medium

CVE-2026-71554 3 months ago

h2: Duplicate Host header could facilitate request smuggling

python-hyper h2

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP…

6.9Medium

CVE-2025-57804 1 year ago

h2 allows HTTP Request Smuggling due to illegal characters in headers

python-hyper h2

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrad…

1.9%EPSS

9.1Critical

CVE-2025-43859 1 year ago

h11 accepts some malformed Chunked-Encoding bodies

python-hyper h11

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in versio…