h2 unbounded empty DATA frames
| Details |
|
| Package |
h2 |
| Version |
0.4.15 |
| URL |
GHSA-q83h-524g-xf6h |
| Date |
2026-08-17 |
| Patched versions |
>=0.4.16 |
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
See advisory page for additional details.
h20.4.15>=0.4.16The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
See advisory page for additional details.