Vulnerability RUSTSEC-2026-0258
Unknown
UNKNOWN RISK
Vulnerabilities without an assigned CVSS score. Severity is not determinable from available data.
1 month ago
August 17, 2026 at 12:00 PM UTC
h2 unbounded empty DATA frames
0.0.0 - 0.1.26 and 0.2.0 - 0.4.15
0.0.0 - 0.1.26 and 0.2.0 - 0.4.15
Summary
h2 unbounded empty DATA frames
Details
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
Related Vulnerabilities
Other vulnerabilities affecting the same packages
Medium Risk
2 years ago
h2 servers vulnerable to degradation of service with CONTINUATION Flood
0.0.0 - 0.1.26 and 0.2.0 - 0.3.25 and 0.4.0 - 0.4.3 GHSA-q6cp-qfwq-4gcv
0.0.0 - 0.1.26 and 0.2.0 - 0.3.25 and 0.4.0 - 0.4.3 GHSA-q6cp-qfwq-4gcv
Unknown
2 years ago
Degradation of service in h2 servers with CONTINUATION Flood
0.0.0 - 0.1.26 and 0.2.0 - 0.3.25 RUSTSEC-2024-0332
0.0.0 - 0.1.26 and 0.2.0 - 0.3.25 RUSTSEC-2024-0332
Medium Risk
2 years ago
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
0.0.0 - 0.1.26 and 0.2.0 - 0.3.23 and 0.4.0 - 0.4.1 GHSA-8r5v-vm4m-4g25
0.0.0 - 0.1.26 and 0.2.0 - 0.3.23 and 0.4.0 - 0.4.1 GHSA-8r5v-vm4m-4g25
Unknown
2 years ago
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
0.0.0 - 0.1.26 and 0.2.0 - 0.3.23 RUSTSEC-2024-0003
0.0.0 - 0.1.26 and 0.2.0 - 0.3.23 RUSTSEC-2024-0003
Unknown
3 years ago
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
0.0.0 - 0.1.26 and 0.2.0 - 0.3.16 RUSTSEC-2023-0034
0.0.0 - 0.1.26 and 0.2.0 - 0.3.16 RUSTSEC-2023-0034
Impacted packages
Timeline
Published
1 month ago
August 17, 2026 at 12:00 PM UTC
Fixed (0.4.16)
1 month ago
August 17, 2026 at 01:00 PM UTC
Last Modified
1 hour ago
October 12, 2026 at 06:00 PM UTC