~ / search / GHSA-f8vr-r385-rh5r

GHSA-f8vr-r385-rh5r

h2 vulnerable to denial of service

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-26964

Packages

EcosystemPackageAffectedFixed in
crates.io h2 < 0.3.17 0.3.17

Details

As written in the advisory (Markdown source, shown as plain text).

Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). This issue affects users only when dealing with http2 connections.

References

External links from the advisory. They lead to third-party sites.