MGASA-2026-0349

See a problem?
Please try reporting it to the source first.
Source
https://advisories.mageia.org/MGASA-2026-0349.html
Import Source
https://advisories.mageia.org/MGASA-2026-0349.json
JSON Data
https://api.osv.dev/v1/vulns/MGASA-2026-0349
Upstream
  • CVE-2026-59980
Published
2026-08-31T19:40:26Z
Modified
2026-09-01T03:15:03.616845841Z
Summary
Updated python-hpack packages fix a security vulnerability
Details

An issue was found in the python-hyper/hpack library, most commonly used as a downstream dependency of the python-hyper/h2 library (an HTTP/2 client and server implementation). Unbounded variable integer decoding can cause run-away computation on malformed input leading to O(n^2) runtime, effectively blocking further processing with large enough unsanitized input. A fix python-hyper/hpack v4.2.0 restricts variable integer decoding to uint32 to prevent run-away computation.

References
Credits

Affected packages

Mageia:10 / python-hpack

Package

Name
python-hpack
Purl
pkg:rpm/mageia/python-hpack?arch=source&distro=mageia-10

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
4.2.0-1.mga10

Ecosystem specific 

{
    "section": "core"
}

Database specific

source 
"https://advisories.mageia.org/MGASA-2026-0349.json"