The vulnerability is an unbounded variable integer decoding flaw in the hpack library that permits an attacker to supply malformed HTTP/2 header blocks containing long runs of 0xFF bytes. When decoded, the library performs an O(n²) integer parsing routine that can consume quadratic amounts of CPU time or memory, effectively blocking normal processing. This results in a denial‑of‑service condition for the affected process or service.

The flaw affects the python‑hyper hpack library on any platform where the library is used to decode HTTP/2 headers. Versions prior to 4.2.0 are vulnerable. The issue applies to Python applications that incorporate the hpack decoder, such as web servers or middleware frameworks that implement HTTP/2.

The CVSS score of 6.3 indicates moderate severity, and the EPSS score is not available, meaning the exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the likely attack vector is dispatching crafted HTTP/2 frame payloads with long sequences of 0xFF bytes. Attackers could trigger a denial‑of‑service by sending such payloads, and the run‑away computation could deplete CPU resources and stall the application, impacting availability. Mitigation requires a patch or proper input sanitization.