—
RUSTSEC-2026-0258
h2 unbounded empty DATA frames
Details
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
Are you affected?
Enter the version of the package you're using.
Affected packages
crates.io / h2
Introduced in:
0.0.0-0 Fixed in: 0.4.16 Upgrade h2 to 0.4.16 or newer (ecosystem crates.io).