Python-hyper - vulnerabilities (CVEs)

5 CVEs in 4 products, 1 in the last 30 days, newest from 2026-10-22.

Products

• H2 - 2 CVEs
• Brotlicffi - 1 CVEs
• H11 - 1 CVEs
• Hpack - 1 CVEs

Newest CVEs of Python-hyper

• CVE-2026-111497 - CVSS 9.8 (critical), 2026-10-22: A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote…
• CVE-2026-59980 - CVSS 6.3 (medium), 2026-09-23: hpack is an HTTP/2 Header Encoding for Python. Prior to version 4.2.0, unbounded variable integer decoding can cause run-away computation on malformed input…
• CVE-2026-71554 - CVSS 5.3 (medium), 2026-08-06: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Versions up to and including 4.4.0 accept request header blocks containing more than one Host…
• CVE-2025-57804 - CVSS 6.9 (medium), 2025-08-25: h2 is a pure-Python implementation of a HTTP/2 protocol stack. Prior to version 4.3.0, an HTTP/2 request splitting vulnerability allows attackers to perform…
• CVE-2025-43859 - CVSS 9.1 (critical), 2025-04-24: h11 is a Python implementation of HTTP/1.1. Prior to version 0.16.0, a leniency in h11's parsing of line terminators in chunked-coding message bodies can lead…