CVE-2016-6580

[Lukasa]

The library is vulnerable to a denial of service attack whereby a remote peer
can insert an unbounded number of streams into the priority tree. This consumes
unbounded memory and also increasingly large amounts of CPU, which can
lead to a trivial denial of service against a HTTP/2 server. This vulnerability
is part of a class of vulnerabilities originally reported in this report,
under the section "Victim 3-Dependency and Priority". The document notes in
passing that the dependency tree size is not limited, and that "a server that
naively trusts the client may be foiled to build a dependency tree that will
consume its memory". This is exactly the attack that the priority library is
exposed to.

Sample code to reproduce the vulnerability is below:

import priority

tree = priority.PriorityTree()
x = 1

while True:
    tree.insert_stream(x)
    x += 1

This code will run indefinitely, and eventually exhaust the memory available
to it.