Repository navigation
RUSTSEC-2026-0258: h2 unbounded empty DATA frames #101
Description
| Details | |
|---|---|
| Package | h2 |
| Version | 0.4.7 |
| URL | hyperium/h2#935 |
| Patched Versions | >=0.4.16 |
| Aliases | GHSA-q83h-524g-xf6h |
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
Activity