CVE-2016-6581

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.

• CWE-399

• http://www.securityfocus.com/bid/92315Third Party Advisory, VDB Entry
• https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.htmlMitigation, Vendor Advisory
• http://www.securityfocus.com/bid/92315Third Party Advisory, VDB Entry
• https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.htmlMitigation, Vendor Advisory

Published

Jan 10, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2016-6565The Imagely NextGen Gallery plugin for Wordpress prior to ve…
• CVE-2016-6566The valueAsString parameter inside the JSON payload containe…
• CVE-2016-6567SHDesigns' Resident Download Manager provides firmware updat…
• CVE-2016-6578CodeLathe FileCloud, version 13.0.0.32841 and earlier, conta…8.8
• CVE-2016-6579Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2016-6580A HTTP/2 implementation built using any version of the Pytho…
• CVE-2016-6582The Doorkeeper gem before 4.2.0 for Ruby might allow remote …
• CVE-2016-6585A Denial of Service vulnerability exists in Symantec Norton …5.3
• CVE-2016-6586A security bypass vulnerability exists in Symantec Norton Mo…3.7
• CVE-2016-6587An Information Disclosure vulnerability exists in the mid.da…5.5
• CVE-2016-6588A Cross-Site Scripting (XSS) vulnerability exists in the ITM…5.4
• CVE-2016-6589A Denial of Service vulnerability exists in the ITMS workflo…6.5