GitHub Advisoryadvisory · crates.io

GHSA-f8vr-r385-rh5r h2 vulnerable to denial of service

MEDIUM Published 2023-04-11 Modified 2023-05-01 Official page ↗
Aliases
CVE-2023-26964
Ecosystem
crates.io
Packages
h2
Severity
Moderate
Weaknesses
CWE-770
Reviewed
2023-04-11

Affected packages

• crates.io h2: < 0.3.17 → fixed in 0.3.17

Description

Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). This issue affects users only when dealing with http2 connections.

Related

Alias · CVE (1)

  • CVE-2023-26964 An issue was discovered in hyper v0.13.7. vulnerability

Weakness · CWE (1)

  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References