GitHub Advisoryadvisory · crates.io

GHSA-q6cp-qfwq-4gcv h2 servers vulnerable to degradation of service with CONTINUATION Flood

MEDIUM Published 2024-04-05 Modified 2024-04-05 Official page ↗
Ecosystem
crates.io
Packages
h2
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-400, CWE-770
Reviewed
2024-04-05

Affected packages

• crates.io h2: < 0.3.26 → fixed in 0.3.26 • crates.io h2: >= 0.4.0, < 0.4.4 → fixed in 0.4.4

Description

An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage. Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency. More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/. Patches available for 0.4.x and 0.3.x versions.

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References