High severity7.5NVD Advisory· Published Jan 10, 2017· Updated Jun 17, 2026
CVE-2016-6581
CVE-2016-6581
Description
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
hpackPyPI | >= 1.0.0, < 2.3.0 | 2.3.0 |
Affected products
9cpe:2.3:a:python:hpack:1.0:*:*:*:*:*:*:*+ 4 more
- cpe:2.3:a:python:hpack:1.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:hpack:2.0:*:*:*:*:*:*:*
- cpe:2.3:a:python:hpack:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:hpack:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:python:hpack:2.2:*:*:*:*:*:*:*
cpe:2.3:a:python:hyper:0.4:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:python:hyper:0.4:*:*:*:*:*:*:*
- cpe:2.3:a:python:hyper:0.6:*:*:*:*:*:*:*
- ghsa-coords2 versions
>= 1.0.0, < 2.3.0+ 1 more
- (no CPE)range: >= 1.0.0, < 2.3.0
- (no CPE)range: < 4.0.0-2.7
Patches
Vulnerability mechanics
References
7- www.securityfocus.com/bid/92315nvdThird Party AdvisoryVDB Entry
- github.com/advisories/GHSA-ffq8-576r-v26gghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2016-6581ghsaADVISORY
- python-hyper.org/hpack/en/latest/security/CVE-2016-6581.htmlnvdMitigationVendor AdvisoryWEB
- python-hyper.org/projects/hpack/en/stable/security/CVE-2016-6581.htmlghsaWEB
- github.com/pypa/advisory-database/tree/main/vulns/hpack/PYSEC-2017-87.yamlghsaWEB
- web.archive.org/web/20200227233559/http://www.securityfocus.com/bid/92315ghsaWEB
News mentions
4- OpenAI's agent chained decade-old DoS attacks to crash web servers in secondsThe Register Security · Jun 4, 2026
- ‘HTTP/2 Bomb’ Exploit Knocks Web Servers Offline in SecondsSecurityWeek · Jun 3, 2026
- New HTTP/2 Bomb Vulnerability Allows Remote DoS on NGINX, Apache, IIS, Envoy & CloudflareThe Hacker News · Jun 3, 2026
- HTTP/2 Bomb — Remote DoS Exploit Hits nginx, Apache, IIS, Envoy, and Cloudflare PingoraCyber Security News · Jun 3, 2026