CVE-2016-6580

A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.

• CWE-399

• http://www.securityfocus.com/bid/92311Third Party Advisory, VDB Entry
• https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.htmlMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/92311Third Party Advisory, VDB Entry
• https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.htmlMitigation, Vendor Advisory

Published

Jan 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6564Android devices with code from Ragentek contain a privileged…
• CVE-2016-6565The Imagely NextGen Gallery plugin for Wordpress prior to ve…
• CVE-2016-6566The valueAsString parameter inside the JSON payload containe…
• CVE-2016-6567SHDesigns' Resident Download Manager provides firmware updat…
• CVE-2016-6578CodeLathe FileCloud, version 13.0.0.32841 and earlier, conta…8.8
• CVE-2016-6579Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6581A HTTP/2 implementation built using any version of the Pytho…
• CVE-2016-6582The Doorkeeper gem before 4.2.0 for Ruby might allow remote …
• CVE-2016-6585A Denial of Service vulnerability exists in Symantec Norton …5.3
• CVE-2016-6586A security bypass vulnerability exists in Symantec Norton Mo…3.7
• CVE-2016-6587An Information Disclosure vulnerability exists in the mid.da…5.5
• CVE-2016-6588A Cross-Site Scripting (XSS) vulnerability exists in the ITM…5.4