Vulnerabilidades de python-hyper (CVE)

Registros CVE publicados para python-hyper, los más recientes primero. Siga el producto para recibir un correo con cada nueva.

5 resultados

9.2Crítica

CVE-2026-111497 KEV hace 18 días

Out-of-Bounds Write in Google Brotli Decoder

Google Brotli; Siemens Cloud Connector Configurator; Siemens Common Configurator (CC on IEM); Siemens Common Configurator on Device (CC on Edge)

A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause …

83%EPSS

6.3Media

CVE-2026-59980 hace 1 mes

hpack: Unbounded variable integer decoding can cause run-away computation on malformed input

python-hyper hpack

hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input…

5.3Media

CVE-2026-71554 hace 3 meses

h2: Duplicate Host header could facilitate request smuggling

python-hyper h2

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host header, and forward every Host header to the consuming application. Where the consumer downgrades HTTP…

6.9Media

CVE-2025-57804 hace 1 año

h2 allows HTTP Request Smuggling due to illegal characters in headers

python-hyper h2

h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform request smuggling attacks by injecting CRLF characters into headers. This occurs when servers downgrad…

1.9%EPSS

9.1Crítica

CVE-2025-43859 hace 1 año

h11 accepts some malformed Chunked-Encoding bodies

python-hyper h11

h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead to request smuggling vulnerabilities under certain conditions. This issue has been patched in versio…