{"id":510,"library":"hpack","title":"HPACK Header Encoding","description":"hpack is a pure-Python library implementing the HPACK (Header Compression for HTTP/2) algorithm, adhering strictly to RFC 7541. It provides `Encoder` and `Decoder` classes for compressing and decompressing HTTP/2 headers efficiently. Maintained by the python-hyper project, it is currently at version 4.1.0 and sees releases periodically, with major versions several years apart, indicating stable and active maintenance.","status":"active","version":"4.1.0","language":"python","source_language":"en","source_url":"https://github.com/python-hyper/hpack/","tags":["HTTP/2","HPACK","header compression","networking"],"install":[{"cmd":"pip install hpack","lang":"bash","label":"Install latest version"}],"dependencies":[],"imports":[{"symbol":"Encoder","correct":"from hpack import Encoder"},{"symbol":"Decoder","correct":"from hpack import Decoder"}],"quickstart":{"code":"from hpack import Encoder, Decoder\n\n# Example headers\nheaders = [\n    (':method', 'GET'),\n    (':path', '/resource'),\n    ('user-agent', 'hpack-client/1.0'),\n    ('accept-encoding', 'gzip, deflate, br')\n]\n\n# Encode headers\nencoder = Encoder()\nencoded_bytes = encoder.encode(headers)\nprint(f\"Encoded bytes: {encoded_bytes.hex()}\")\n\n# Decode headers\ndecoder = Decoder()\ndecoded_headers = decoder.decode(encoded_bytes)\nprint(f\"Decoded headers: {decoded_headers}\")","lang":"python","description":"Initializes an HPACK Encoder and Decoder, then demonstrates encoding a list of HTTP/2 headers into bytes and subsequently decoding them back to a list of header tuples."},"warnings":[{"fix":"Review `nghttp2` integration. For 3.0.0, consider using pure-Python implementation or downgrading/upgrading past 3.0.0 if `nghttp2` performance is critical. Newer versions (4.x) handle `nghttp2` transparently if installed.","message":"In version 3.0.0, the explicit support for the `nghttp2` C-based backend was temporarily removed due to being non-functional. While later versions have re-integrated transparent `nghttp2` usage, this change was breaking for applications directly relying on `nghttp2` integration in 3.0.0.","severity":"breaking","affected_versions":"3.0.0"},{"fix":"Ensure your encoding logic respects the `Encoder`'s header table size limits. Catch `InvalidTableSizeError` if necessary and adjust header field handling.","message":"Starting with version 3.0.0, the `Encoder` strictly enforces the maximum allowed header table size. Attempts to exceed this limit via dynamic table size updates will now raise `InvalidTableSizeError`.","severity":"breaking","affected_versions":">=3.0.0"},{"fix":"Upgrade to `hpack` version 2.3.0 or newer immediately. Configure `Decoder.max_header_list_size` to a sensible limit to protect against this vulnerability (default is 64kB).","message":"Versions of `hpack` prior to 2.3.0 were vulnerable to the 'HPACK Bomb' denial-of-service attack (CVE-2016-6581), where a small compressed header block could decompress into a disproportionately large amount of memory. Version 2.3.0 introduced `Decoder.max_header_list_size` to mitigate this.","severity":"gotcha","affected_versions":"<2.3.0"},{"fix":"Update exception handling to catch `HPACKDecodingError` or its subclasses like `InvalidTableIndex` for more precise error management during HPACK decoding.","message":"In versions 2.1.0 and 2.3.0, several generic exceptions (`IndexError`, `UnicodeDecodeError`) raised during decoding were replaced with more specific `HPACKDecodingError` and `InvalidTableIndex`. Code catching the older, broader exceptions might no longer correctly handle specific HPACK-related failures.","severity":"gotcha","affected_versions":">=2.1.0"},{"fix":"Adjust type checks to acknowledge `HeaderTuple` or rely on duck-typing if only tuple-like behavior (iteration, indexing) is expected. These objects are subclasses of `tuple` and should be compatible for most uses.","message":"As of version 2.2.0, the `Decoder.decode()` method returns `HeaderTuple` or `NeverIndexedHeaderTuple` objects instead of plain tuples. While these behave largely like 2-tuples, code performing strict type-checking (e.g., `isinstance(header, tuple)`) might be affected.","severity":"gotcha","affected_versions":">=2.2.0"}],"env_vars":null,"search_vec":"'4.1.0':49 '7541':23 'activ':63 'adher':19 'algorithm':18 'apart':59 'class':29 'compress':15,31,68 'current':46 'decod':28 'decompress':33 'effici':36 'encod':3,26 'header':2,14,35,67 'hpack':1,4,13,66 'http/2':17,34,65 'hyper':42 'implement':11 'indic':60 'librari':10 'maintain':37 'mainten':64 'major':55 'network':69 'period':53 'project':43 'provid':25 'pure':8 'pure-python':7 'python':9,41 'python-hyp':40 'releas':52 'rfc':22 'see':51 'sever':57 'stabl':61 'strict':20 'version':48,56 'year':58","created_at":"2026-03-28T15:16:43.093637+00:00","updated_at":"2026-04-16T15:35:44.157522+00:00","problems":[{"fix":"Install the hpack library using pip: `pip install hpack`","cause":"The 'hpack' library is not installed in your Python environment or the Python interpreter cannot find it in its search path.","error":"ModuleNotFoundError: No module named 'hpack'"},{"fix":"Ensure that the input data to the `Decoder.decode()` method is valid HPACK, and if header values are not strictly UTF-8, consider using `d.decode(encoded_bytes, raw=True)` to receive raw byte strings for header values.","cause":"The HPACK-encoded header block contains byte sequences that cannot be correctly decoded as UTF-8, which is the default decoding for header values in hpack.","error":"hpack.exceptions.HPACKDecodingError: Unable to decode headers as UTF-8."},{"fix":"If safe and necessary, increase the `max_header_list_size` limit when initializing the `hpack.Decoder`: `d = Decoder(max_header_list_size=131072)` (for 128kB). Otherwise, the received header block is considered malicious or malformed and the connection should be shut down.","cause":"The decompressed size of the header list exceeds the maximum allowed size configured for the `hpack.Decoder` instance (defaulting to 64kB to prevent 'HPACK Bomb' attacks).","error":"hpack.exceptions.OversizedHeaderListError: A header list larger than <max_size> has been received"},{"fix":"Ensure that all integer inputs to hpack encoding functions adhere to the specified constraints, typically requiring positive or non-negative values.","cause":"An attempt was made to encode a negative integer using an hpack function (e.g., `encode_integer`) that only accepts non-negative or positive integer values as per the HPACK specification.","error":"ValueError: Can only encode positive integers, got -1"}],"ecosystem":"pypi","meta_description":null,"install_score":100,"quickstart_score":80,"quickstart_tag":"verified","pypi_latest":"4.1.0","cli_name":"","cli_version":null,"type":"library","homepage":null,"github":"https://github.com/python-hyper/hpack","docs":"https://python-hyper.org/","changelog":null,"pypi":"https://pypi.org/project/hpack/","npm":null,"openapi_spec":null,"status_page":null,"smithery":null,"categories":["http-networking"],"base_url":null,"auth_type":null,"provenance":{"verified_status":"passing","verified_at":"2026-06-28","last_verified":"2026-06-28","next_check":"2026-07-28","install_tag":"verified"}}