—

RUSTSEC-2024-0332

Degradation of service in h2 servers with CONTINUATION Flood

Details

An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at "https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

Are you affected?

Enter the version of the package you're using.

Affected packages

crates.io/h2

Introduced in: 0.0.0-0Fixed in: 0.3.26

Upgrade h2 to 0.3.26 or newer (ecosystem crates.io).

References

https://crates.io/crates/h2[PACKAGE]
https://rustsec.org/advisories/RUSTSEC-2024-0332.html[ADVISORY]
https://seanmonstar.com/blog/hyper-http2-continuation-flood/[WEB]