GHSA-8r5v-vm4m-4g25 RUSTSEC-2024-0003
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
- Exploit chance (EPSS)
- 82.81%
- Chance of exploitation in the next 30 days. Higher than 99.67% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
0.3.24- Upgrade h2 to this version or later
Description
An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out Of Memory (OOM) and high CPU usage.
This fix is corrected in hyperium/h2#737, which limits the total number of internal error resets emitted by default before the connection is closed.
Affected versions
crates.io
| Package | Vulnerable | Fixed in |
|---|---|---|
| h2 | < 0.3.24 |
0.3.24 |
| h2 | >= 0.4.0, < 0.4.2 |
0.4.2 |
| h2 | >= 0.0.0-0, < 0.3.24>= 0.4.0-0, < 0.4.2 |
0.3.240.4.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
h2 crates.io → 0.3.24
- cargo
cargo update -p h2 --precise 0.3.24
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-39qc-96h7-956f golang.org/x/net/http vulnerable to a reset flood | High | Linked by the source |
| RUSTSEC-2026-0258 h2 unbounded empty DATA frames | Not rated yet | Also affects h2 |
| GHSA-q6cp-qfwq-4gcv h2 servers vulnerable to degradation of service with CONTINUATION Flood | Medium | Also affects h2 |
| GHSA-f8vr-r385-rh5r h2 vulnerable to denial of service | High | Also affects h2 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor