CVE-2016-6580

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2017-01-10 · updated 2026-06-17
Weakness: CWE-399

Description

A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could be targeted by a malicious peer by having that peer assign priority information for every possible HTTP/2 stream ID. The priority tree would happily continue to store the priority information for each stream, and would therefore allocate unbounded amounts of memory. Attempting to actually use a tree like this would also cause extremely high CPU usage to maintain the tree.

Affected products

Python Priority Library: 1.0.0, 1.1.0, 1.1.1

References

http://www.securityfocus.com/bid/92311
https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.html
http://www.securityfocus.com/bid/92311
https://python-hyper.org/priority/en/latest/security/CVE-2016-6580.html

Get alerted when CVE-2016-6580 or the next vulnerability affects your stack