GHSA-8r5v-vm4m-4g25
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out Of Memory (OOM) and high CPU usage.
This fix is corrected in hyperium/h2#737, which limits the total number of internal error resets emitted by default before the connection is closed.
What each source reports
GitHub AdvisoriesNo score
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out Of Memory (OOM) and high CPU usage.
This fix is corrected in hyperium/h2#737, which limits the total number of internal error resets emitted by default before the connection is closed.
- Record
GHSA-8r5v-vm4m-4g25- Updated
- 2026-11-02
OSVNo score
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out Of Memory (OOM) and high CPU usage.
This fix is corrected in hyperium/h2#737, which limits the total number of internal error resets emitted by default before the connection is closed.
- Record
GHSA-8r5v-vm4m-4g25- Updated
- 2026-11-02
OSVRUSTSEC-2024-0003No score
Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
An attacker with an HTTP/2 connection to an affected endpoint can send a steady stream of invalid frames to force the generation of reset frames on the victim endpoint. By closing their recv window, the attacker could then force these resets to be queued in an unbounded fashion, resulting in Out Of Memory (OOM) and high CPU usage.
This fix is corrected in hyperium/h2#737, which limits the total number of internal error resets emitted by default before the connection is closed.
- Record
RUSTSEC-2024-0003- Updated
- 2026-11-02
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
GHSA-8r5v-vm4m-4g25 is a vulnerability with no CVSS score yet in h2, published January 17, 2024. No source lists public exploit code. Fixed in h2 0.3.24.
References
github.com/hyperium/h2/pull/737
rustsec.org/advisories/RUSTSEC-2024-0003.html
crates.io/crates/h2