A vulnerability in the hpack library allows unauthenticated remote attackers to cause a denial of service through unbounded variable integer decoding.

This is an uncontrolled resource consumption vulnerability (CWE-400) where the hpack decoder fails to limit integer decoding sizes, allowing an attacker to send crafted inputs that force excessive CPU usage and block further processing. The attack vector is network-based and requires no authentication.

The primary impact of this vulnerability is a denial of service condition for applications relying on the hpack library for HTTP/2 header processing. Given the CVSS score of 6.3, this flaw represents a significant risk to service availability, as an attacker can effectively halt network communication for vulnerable systems. Prolonged downtime can disrupt critical business operations and impact user access to dependent services.

Immediate Action: Update the hpack library to version 4.2.0 or later to implement the necessary restrictions on variable integer decoding.

Proactive Monitoring: Monitor application performance logs for spikes in CPU utilization or sudden increases in processing latency during HTTP/2 request handling.

Compensating Controls: If immediate updates are not feasible, implement input sanitization to block sequences of 0xFF values in incoming header data, though upgrading remains the only complete resolution.

Public Exploit Available: No

This vulnerability poses a moderate risk to system availability and should be addressed as part of the standard patch management cycle. Organizations should prioritize updating to version 4.2.0 to eliminate the risk of resource exhaustion attacks. Given the library-only nature of the flaw, ensure all downstream dependencies are verified for the patched version.