Vulnerability GHSA-q6cp-qfwq-4gcv

Medium Risk

2 years ago

h2 servers vulnerable to degradation of service with CONTINUATION Flood

0.0.0 - 0.1.26 and 0.2.0 - 0.3.25 and 0.4.0 - 0.4.3

Summary

h2 servers vulnerable to degradation of service with CONTINUATION Flood

Details

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

References

Related Vulnerabilities

Other vulnerabilities affecting the same packages

Unknown

1 month ago

h2 unbounded empty DATA frames

0.0.0 - 0.1.26 and 0.2.0 - 0.4.15 RUSTSEC-2026-0258

Unknown

2 years ago

Degradation of service in h2 servers with CONTINUATION Flood

0.0.0 - 0.1.26 and 0.2.0 - 0.3.25 RUSTSEC-2024-0332

Medium Risk

2 years ago

Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

0.0.0 - 0.1.26 and 0.2.0 - 0.3.23 and 0.4.0 - 0.4.1 GHSA-8r5v-vm4m-4g25

Unknown

2 years ago

Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

0.0.0 - 0.1.26 and 0.2.0 - 0.3.23 RUSTSEC-2024-0003

Unknown

3 years ago

Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

0.0.0 - 0.1.26 and 0.2.0 - 0.3.16 RUSTSEC-2023-0034

View all vulnerabilities for these packages

Impacted packages

Timeline

Published

2 years ago

Fixed (0.3.26)

2 years ago

Fixed (0.4.4)

2 years ago

Last Modified

1 month ago