Reported

August 17, 2026

Issued

August 18, 2026

Package

h2 (crates.io)

Type

Vulnerability

Categories

• denial-of-service

Keywords

#http #http2 #h2

Aliases

• GHSA-q83h-524g-xf6h

References

• https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h

Patched

• >=0.4.16

Description

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

Advisory available under CC0-1.0 license.