{"id":510,"library":"hpack","title":"HPACK Header Encoding","description":"hpack is a pure-Python library implementing the HPACK (Header Compression for HTTP/2) algorithm, adhering strictly to RFC 7541. It provides `Encoder` and `Decoder` classes for compressing and decompressing HTTP/2 headers efficiently. Maintained by the python-hyper project, it is currently at version 4.1.0 and sees releases periodically, with major versions several years apart, indicating stable and active maintenance.","status":"active","version":"4.1.0","language":"python","source_language":"en","source_url":"https://github.com/python-hyper/hpack/","tags":["HTTP/2","HPACK","header compression","networking"],"install":[{"cmd":"pip install hpack","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"symbol":"Encoder","correct":"from hpack import Encoder"},{"symbol":"Decoder","correct":"from hpack import Decoder"}],"quickstart":{"code":"from hpack import Encoder, Decoder\n\n# Example headers\nheaders = [\n    (':method', 'GET'),\n    (':path', '/resource'),\n    ('user-agent', 'hpack-client/1.0'),\n    ('accept-encoding', 'gzip, deflate, br')\n]\n\n# Encode headers\nencoder = Encoder()\nencoded_bytes = encoder.encode(headers)\nprint(f\"Encoded bytes: {encoded_bytes.hex()}\")\n\n# Decode headers\ndecoder = Decoder()\ndecoded_headers = decoder.decode(encoded_bytes)\nprint(f\"Decoded headers: {decoded_headers}\")","lang":"python","description":"Initializes an HPACK Encoder and Decoder, then demonstrates encoding a list of HTTP/2 headers into bytes and subsequently decoding them back to a list of header tuples."},"warnings":[{"fix":"Review `nghttp2` integration. For 3.0.0, consider using pure-Python implementation or downgrading/upgrading past 3.0.0 if `nghttp2` performance is critical. Newer versions (4.x) handle `nghttp2` transparently if installed.","message":"In version 3.0.0, the explicit support for the `nghttp2` C-based backend was temporarily removed due to being non-functional. While later versions have re-integrated transparent `nghttp2` usage, this change was breaking for applications directly relying on `nghttp2` integration in 3.0.0.","severity":"breaking","affected_versions":"3.0.0"},{"fix":"Ensure your encoding logic respects the `Encoder`'s header table size limits. Catch `InvalidTableSizeError` if necessary and adjust header field handling.","message":"Starting with version 3.0.0, the `Encoder` strictly enforces the maximum allowed header table size. Attempts to exceed this limit via dynamic table size updates will now raise `InvalidTableSizeError`.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Upgrade to `hpack` version 2.3.0 or newer immediately. Configure `Decoder.max_header_list_size` to a sensible limit to protect against this vulnerability (default is 64kB).","message":"Versions of `hpack` prior to 2.3.0 were vulnerable to the 'HPACK Bomb' denial-of-service attack (CVE-2016-6581), where a small compressed header block could decompress into a disproportionately large amount of memory. Version 2.3.0 introduced `Decoder.max_header_list_size` to mitigate this.","severity":"gotcha","affected_versions":"<2.3.0"},{"fix":"Update exception handling to catch `HPACKDecodingError` or its subclasses like `InvalidTableIndex` for more precise error management during HPACK decoding.","message":"In versions 2.1.0 and 2.3.0, several generic exceptions (`IndexError`, `UnicodeDecodeError`) raised during decoding were replaced with more specific `HPACKDecodingError` and `InvalidTableIndex`. Code catching the older, broader exceptions might no longer correctly handle specific HPACK-related failures.","severity":"gotcha","affected_versions":">=2.1.0"},{"fix":"Adjust type checks to acknowledge `HeaderTuple` or rely on duck-typing if only tuple-like behavior (iteration, indexing) is expected. These objects are subclasses of `tuple` and should be compatible for most uses.","message":"As of version 2.2.0, the `Decoder.decode()` method returns `HeaderTuple` or `NeverIndexedHeaderTuple` objects instead of plain tuples. While these behave largely like 2-tuples, code performing strict type-checking (e.g., `isinstance(header, tuple)`) might be affected.","severity":"gotcha","affected_versions":">=2.2.0"}],"env_vars":null,"last_verified":"2026-05-12T14:30:34.690Z","next_check":"2026-06-26T00:00:00.000Z","problems":[{"fix":"Install the hpack library using pip: `pip install hpack`","cause":"The 'hpack' library is not installed in your Python environment or the Python interpreter cannot find it in its search path.","error":"ModuleNotFoundError: No module named 'hpack'"},{"fix":"Ensure that the input data to the `Decoder.decode()` method is valid HPACK, and if header values are not strictly UTF-8, consider using `d.decode(encoded_bytes, raw=True)` to receive raw byte strings for header values.","cause":"The HPACK-encoded header block contains byte sequences that cannot be correctly decoded as UTF-8, which is the default decoding for header values in hpack.","error":"hpack.exceptions.HPACKDecodingError: Unable to decode headers as UTF-8."},{"fix":"If safe and necessary, increase the `max_header_list_size` limit when initializing the `hpack.Decoder`: `d = Decoder(max_header_list_size=131072)` (for 128kB). Otherwise, the received header block is considered malicious or malformed and the connection should be shut down.","cause":"The decompressed size of the header list exceeds the maximum allowed size configured for the `hpack.Decoder` instance (defaulting to 64kB to prevent 'HPACK Bomb' attacks).","error":"hpack.exceptions.OversizedHeaderListError: A header list larger than <max_size> has been received"},{"fix":"Ensure that all integer inputs to hpack encoding functions adhere to the specified constraints, typically requiring positive or non-negative values.","cause":"An attempt was made to encode a negative integer using an hpack function (e.g., `encode_integer`) that only accepts non-negative or positive integer values as per the HPACK specification.","error":"ValueError: Can only encode positive integers, got -1"}],"ecosystem":"pypi","meta_description":null,"install_score":100,"install_tag":"verified","quickstart_score":80,"quickstart_tag":"verified","pypi_latest":null,"install_checks":{"last_tested":"2026-05-12","tag":"verified","tag_description":"installs cleanly on critical runtimes, fast import, recently tested","results":[{"runtime":"python:3.10-alpine","python_version":"3.10","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":1.29,"mem_mb":2.1,"disk_size":"18.4M"},{"runtime":"python:3.10-slim","python_version":"3.10","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":2.1,"mem_mb":2.1,"disk_size":"19M"},{"runtime":"python:3.11-alpine","python_version":"3.11","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.75,"mem_mb":2,"disk_size":"20.0M"},{"runtime":"python:3.11-slim","python_version":"3.11","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.51,"mem_mb":2,"disk_size":"21M"},{"runtime":"python:3.12-alpine","python_version":"3.12","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.58,"mem_mb":1.8,"disk_size":"11.9M"},{"runtime":"python:3.12-slim","python_version":"3.12","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.57,"mem_mb":1.8,"disk_size":"12M"},{"runtime":"python:3.13-alpine","python_version":"3.13","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.6,"mem_mb":2,"disk_size":"11.6M"},{"runtime":"python:3.13-slim","python_version":"3.13","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.63,"mem_mb":1.9,"disk_size":"12M"},{"runtime":"python:3.9-alpine","python_version":"3.9","os_libc":"alpine (musl)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.04,"mem_mb":1.7,"disk_size":"17.6M"},{"runtime":"python:3.9-slim","python_version":"3.9","os_libc":"slim (glibc)","variant":"default","exit_code":0,"wheel_type":null,"failure_reason":null,"install_time_s":null,"import_time_s":0.05,"mem_mb":1.7,"disk_size":"18M"}]},"quickstart_checks":{"last_tested":"2026-04-23","tag":"verified","tag_description":"quickstart runs on critical runtimes, recently tested","results":[{"runtime":"python:3.10-alpine","exit_code":0},{"runtime":"python:3.10-slim","exit_code":0},{"runtime":"python:3.11-alpine","exit_code":0},{"runtime":"python:3.11-slim","exit_code":0},{"runtime":"python:3.12-alpine","exit_code":0},{"runtime":"python:3.12-slim","exit_code":0},{"runtime":"python:3.13-alpine","exit_code":0},{"runtime":"python:3.13-slim","exit_code":0},{"runtime":"python:3.9-alpine","exit_code":0},{"runtime":"python:3.9-slim","exit_code":0}]}}