CVE-2016-6580: A HTTP/2 implementation built using any version of the Python priority library prior to version 1.2.0 could...

Security readout for executives and security teams

This is a denial-of-service flaw in Python's priority library, used by some HTTP/2 implementations. A malicious peer could make the service store priority data for every possible stream ID, consuming unbounded memory and high CPU. Sources do not provide CVSS, known exploitation, or named affected products beyond uses of priority before 1.2.0. Exposure is most likely in Python applications, services, or dependencies that implement HTTP/2 using priority versions earlier than 1.2.0. The bundle does not identify specific downstream products or deployments. Treat as a targeted availability risk, not confirmed active exploitation. It deserves remediation where HTTP/2 services are reachable by untrusted peers, especially for customer-facing or operationally critical systems. Mitigation focus: Upgrade Python priority to version 1.2.0 or later where directly used.; Check downstream HTTP/2 frameworks for bundled or pinned vulnerable priority versions.; Review vendor advisories for products that embed Python priority indirectly..

Prepared

Jun 13, 2026, 13:16 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.