-
-
Notifications
You must be signed in to change notification settings - Fork 190
RUSTSEC-2026-0258: h2 unbounded empty DATA frames #1304
Open
Assignees
Description
h2 unbounded empty DATA frames
| Details | |
|---|---|
| Package | h2 |
| Version | 0.4.15 |
| URL | GHSA-q83h-524g-xf6h |
| Date | 2026年08月17日 |
| Patched versions | >=0.4.16 |
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
See advisory page for additional details.