GHSA-q83h-524g-xf6h
h2 unbounded empty DATA frames
GHSA-q83h-524g-xf6h is a vulnerability with no CVSS score yet in h2, published August 17, 2026. No source lists public exploit code. Fixed in h2 0.4.16.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.4.16h2
Description
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
h2crates.io | 0.0.0-0 up to 0.4.16 | 0.4.16 |
What each source reports
OSVRUSTSEC-2026-0258No score
h2 unbounded empty DATA frames
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
- Record
RUSTSEC-2026-0258- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.