CVE-2016-6581

Name: CVE-2016-6581
Creator: NVD / NIST
Published: 2017-01-10T15:59:00.423+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 1.76%

Last modified Jun 17, 2026

CVE-2016-6581 is a vulnerability of currently unknown severity. A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. EPSS estimates a 1.76% chance of exploitation in the next 30 days.

Description

A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.

Metrics

EPSS Probability

1.76%

75.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-399

Affected Software

Vendor	Product	Versions
Python	Hpack	1.0
Python	Hpack	2.0
Python	Hpack	2.0.1
Python	Hpack	2.1.1
Python	Hpack	2.2
Python	Hyper	0.4
Python	Hyper	0.6

References

http://www.securityfocus.com/bid/92315Third Party Advisory, VDB Entry
https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.htmlMitigation, Vendor Advisory
http://www.securityfocus.com/bid/92315Third Party Advisory, VDB Entry
https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.htmlMitigation, Vendor Advisory

Timeline

Published: Jan 10, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-6581?

How severe is CVE-2016-6581?

Severity scoring for CVE-2016-6581 is pending analysis. The EPSS model estimates a 1.76% probability of exploitation in the next 30 days.

How do I fix CVE-2016-6581?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-6581?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST