NVD

Id
21287  
Name
CVE-2016-6581  
Description
A HTTP/2 implementation built using any version of the Python HPACK library between v1.0.0 and v2.2.0 could be targeted for a denial of service attack, specifically a so-called "HPACK Bomb" attack. This attack occurs when an attacker inserts a header field that is exactly the size of the HPACK dynamic header table into the dynamic header table. The attacker can then send a header block that is simply repeated requests to expand that field in the dynamic table. This can lead to a gigantic compression ratio of 4,096 or better, meaning that 16kB of data can decompress to 64MB of data on the target machine.  
Reject
 
CVSS Version
2  
CVSS Score
7.8  
Severity
High  
CVSS Base Score
7.8  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:C)  
Pub Date
2017-01-30  
Published
2017-01-10  
Modified Date
2017-01-27  
Seq
2016-6581  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
115501 21287 CVE-2016-6581 92315  View
115502 21287 CVE-2016-6581 https://python-hyper.org/hpack/en/latest/security/CVE-2016-6581.html  View

Related JVN