RUSTSEC-2023-0034

See a problem?
Please try reporting it to the source first.

Source

https://rustsec.org/advisories/RUSTSEC-2023-0034

Import Source

https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2023-0034.json

JSON Data

https://api.osv.dev/v1/vulns/RUSTSEC-2023-0034

Aliases

Published

2023-04-14T12:00:00Z

Modified

2023-11-01T05:01:33.617973Z

Summary

Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

Details

If an attacker is able to flood the network with pairs of HEADERS/RST_STREAM frames, such that the h2 application is not able to accept them faster than the bytes are received, the pending accept queue can grow in memory usage. Being able to do this consistently can result in excessive memory use, and eventually trigger Out Of Memory.

This flaw is corrected in hyperium/h2#668, which restricts remote reset stream count by default.

References

Affected packages

crates.io / h2

Package

Name: h2; View open source insights on deps.dev
Purl: pkg:cargo/h2

Affected ranges

Type: SEMVER
Events: Introduced

0.0.0-0

Fixed

0.3.17

Ecosystem specific

{
    "affected_functions": null,
    "affects": {
        "os": [],
        "functions": [],
        "arch": []
    }
}

Database specific

{
    "cvss": null,
    "informational": null,
    "categories": [
        "denial-of-service"
    ]
}