{"id":"CVE-2023-26964","aliases":["AZL-26291","AZL-26730","AZL-34823","AZL-35217","AZL-61174","DEBIAN-CVE-2023-26964","EUVD-2023-1284","GHSA-f8vr-r385-rh5r","RUSTSEC-2023-0034","SUSE-SU-2023:2603-1","SUSE-SU-2025:02809-1","SUSE-SU-2025:02810-1","SUSE-SU-2025:02811-1","SUSE-SU-2026:3022-1","UBUNTU-CVE-2023-26964","openSUSE-SU-2024:0294-1","openSUSE-SU-2024:12859-1","openSUSE-SU-2024:12861-1","openSUSE-SU-2024:12862-1","openSUSE-SU-2024:12863-1","openSUSE-SU-2024:12864-1","openSUSE-SU-2024:12866-1","openSUSE-SU-2024:12960-1","openSUSE-SU-2024:12973-1","openSUSE-SU-2024:13106-1","openSUSE-SU-2026:12402-1"],"status":"published","title":"h2 vulnerable to denial of service","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01121,"percentile":0.6646,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-770"],"published":"2023-04-11T00:00:00Z","modified":"2026-11-04T17:27:21Z","fixes":[{"ecosystem":"crates.io","package":"h2","fixed_in":["0.3.17"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:2","package":"rpm-ostree","fixed_in":["2022.1-7"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kata-containers","fixed_in":["3.2.0.azl0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kata-containers","fixed_in":["3.2.0.azl0-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rpm-ostree","fixed_in":["2024.4-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"rust","fixed_in":["h2-0.3.26"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rust-h2","fixed_in":["0.3.13-2"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rust-h2","fixed_in":["0.3.13-2"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rust-h2","fixed_in":["0.3.13-2"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rustup","fixed_in":["1.25.2~0-4.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"sccache","fixed_in":["0.4.1~18-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"wasm-pack","fixed_in":["0.11.0~0-2.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"watchexec","fixed_in":["1.22.3-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"pijul","fixed_in":["1.0.0~beta.5-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"hoard","fixed_in":["v.1.4.2~0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.17"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"rpm-ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2022.1-7"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0.azl0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kata-containers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.0.azl0-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rpm-ostree","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2024.4-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"rust","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.85.0"},{"fixed":"h2-0.3.26"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rust-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-2"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rust-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-2"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rust-h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.13-2"}]}]},{"source":"osv","ecosystem":"crates.io","package":"h2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.17"}]}]},{"source":"osv","ecosystem":"crates.io","package":"h2","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.17"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP4","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0~0-150400.3.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP5","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0~0-150400.3.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0~0-150400.3.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.0~0-150400.3.7.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.3","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+141-150400.3.7.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.4","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+141-150400.3.5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Micro 5.5","package":"rust-keylime","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.2.7+141-150500.3.5.1"}]}],"bundled":6},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP6-LTSS","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP6","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.16.0~0-150600.10.11.1"}]}],"bundled":14},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"rust-hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.12.35-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rust-hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["0.14.25-1","0.14.27-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rust-hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rust-hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.8.1-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rust-hyper","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1.5.2-1","1.7.0-1","1.8.1-1"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP6","package":"kanidm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3~git0.f075d13-bp156.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"kanidm","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.3.3~git0.f075d13-bp156.4.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rustup","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.25.2~0-4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"sccache","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.4.1~18-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"wasm-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.11.0~0-2.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"watchexec","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"pijul","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.0~beta.5-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"hoard","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"v.1.4.2~0-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mdbook","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.5.4-1.1"}]}],"bundled":2}],"products":[{"vendor":"hyper","product":"h2"},{"vendor":"hyper","product":"hyper"}],"references":[{"url":"https://github.com/hyperium/hyper/issues/2877","tags":["x_transferred","Exploit","Issue Tracking","report","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZYRZ5Y2ALATKKPIITAFAJIS4TR4LUAHO/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZHBAE7LQARMPUEEV4TWET4D7G6WCWBUD/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-26964","tags":["web","advisory"]},{"url":"https://github.com/hyperium/h2/issues/621","tags":["web"]},{"url":"https://github.com/hyperium/h2/pull/668","tags":["web"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2023-0034.html","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-f8vr-r385-rh5r"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/26xxx/CVE-2023-26964.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-26964","tags":["advisory"]},{"url":"https://github.com/hyperium/hyper","tags":["package"]},{"url":"https://crates.io/crates/h2","tags":["package"]},{"url":"https://www.suse.com/support/update/announcement/2023/suse-su-20232603-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1208552","tags":["report"]},{"url":"https://bugzilla.suse.com/1210345","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-31394","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-26964","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502809-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210344","tags":["report"]},{"url":"https://bugzilla.suse.com/1223234","tags":["report"]},{"url":"https://bugzilla.suse.com/1229952","tags":["report"]},{"url":"https://bugzilla.suse.com/1230029","tags":["report"]},{"url":"https://bugzilla.suse.com/1242623","tags":["report"]},{"url":"https://bugzilla.suse.com/1243861","tags":["report"]},{"url":"https://bugzilla.suse.com/1247193","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-12224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-32650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43806","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3416","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58266","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502810-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502811-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20263022-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1210346","tags":["report"]},{"url":"https://bugzilla.suse.com/1223238","tags":["report"]},{"url":"https://bugzilla.suse.com/1229955","tags":["report"]},{"url":"https://bugzilla.suse.com/1242611","tags":["report"]},{"url":"https://bugzilla.suse.com/1243868","tags":["report"]},{"url":"https://bugzilla.suse.com/1257923","tags":["report"]},{"url":"https://bugzilla.suse.com/1270206","tags":["report"]},{"url":"https://bugzilla.suse.com/1270512","tags":["report"]},{"url":"https://bugzilla.suse.com/1270559","tags":["report"]},{"url":"https://bugzilla.suse.com/1270693","tags":["report"]},{"url":"https://bugzilla.suse.com/1270736","tags":["report"]},{"url":"https://bugzilla.suse.com/1270869","tags":["report"]},{"url":"https://bugzilla.suse.com/1270938","tags":["report"]},{"url":"https://bugzilla.suse.com/1270948","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-25727","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41676","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41677","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41678","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41681","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-41898","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-42327","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-44662","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-45784","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2023-26964","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-26964","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5D6EJD2U437T6U4EHNYRU44B2UOGLUUB/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1191031","tags":["report"]},{"url":"https://bugzilla.suse.com/1194119","tags":["report"]},{"url":"https://bugzilla.suse.com/1196972","tags":["report"]},{"url":"https://bugzilla.suse.com/1210356","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2021-45710","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24713","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-58160","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-26964","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T00:00:00Z","modified":"2025-02-11T15:46:26.268Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:35:15.434947Z"}],"euvd":[{"id":"EUVD-2023-1284","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T00:00:00Z","modified":"2025-02-11T15:46:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T00:03:59.282543Z"}],"ghsa":[{"id":"GHSA-f8vr-r385-rh5r","title":"h2 vulnerable to denial of service","description":"Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client \u0026 server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).\n\nThis issue affects users only when dealing with http2 connections.","status":"published","published":"2023-04-11T15:30:30Z","modified":"2023-05-01T21:22:02Z","cwes":["CWE-770"],"updated_at":"2026-11-02T14:36:52.310293Z"}],"nvd":[{"id":"CVE-2023-26964","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07.677Z","modified":"2026-06-17T05:44:01.51Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-770"],"updated_at":"2026-11-02T14:07:53.719171Z"}],"osv":[{"id":"AZL-26291","title":"CVE-2023-26964 affecting package rpm-ostree for versions less than 2022.1-7","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07Z","modified":"2026-04-21T04:23:35.395688Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-26730","title":"CVE-2023-26964 affecting package kata-containers for versions less than 3.2.0.azl0-1","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07Z","modified":"2026-04-21T04:23:47.482182Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.093433Z"},{"id":"AZL-34823","title":"CVE-2023-26964 affecting package kata-containers for versions less than 3.2.0.azl0-2","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07Z","modified":"2026-04-21T04:52:09.351898Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:03.821827Z"},{"id":"AZL-35217","title":"CVE-2023-26964 affecting package rpm-ostree for versions less than 2024.4-1","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07Z","modified":"2026-04-21T04:52:58.474724Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:04.173658Z"},{"id":"AZL-61174","title":"CVE-2023-26964 affecting package rust for versions less than h2-0.3.26","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07Z","modified":"2026-04-21T04:53:32.514021Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:07.517393Z"},{"id":"CVE-2023-26964","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T00:00:00Z","modified":"2026-11-04T17:27:21.260683077Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-04T17:42:13.720113Z"},{"id":"DEBIAN-CVE-2023-26964","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:07.677Z","modified":"2026-10-26T18:02:13.076151954Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:39.679062Z"},{"id":"UBUNTU-CVE-2023-26964","description":"An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).","status":"published","published":"2023-04-11T14:15:00Z","modified":"2026-10-17T12:57:16.298813959Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:54:20.198616Z"},{"id":"GHSA-f8vr-r385-rh5r","title":"h2 vulnerable to denial of service","description":"Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client \u0026 server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).\n\nThis issue affects users only when dealing with http2 connections.","status":"published","published":"2023-04-11T15:30:30Z","modified":"2023-11-08T04:12:03.0117Z","cwes":["CWE-770"],"updated_at":"2026-11-02T15:46:46.006631Z"},{"id":"openSUSE-SU-2024:0294-1","title":"Security update for kanidm","description":"This update for kanidm fixes the following issues:\n\n- kanidm version 1.3.3~git0.f075d13:\n  * Release 1.3.3\n  * Mail substr index (#2981)\n","status":"published","published":"2024-09-09T12:04:21Z","modified":"2026-02-04T02:13:32.494912Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:12859-1","title":"kanidm-1.1.0~alpha11~git0.d3a2a6b-3.1 on GA media","description":"These are all security issues fixed in the kanidm-1.1.0~alpha11~git0.d3a2a6b-3.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:35:37.879971Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12861-1","title":"rustup-1.25.2~0-4.1 on GA media","description":"These are all security issues fixed in the rustup-1.25.2~0-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:12:52.366625Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12862-1","title":"sccache-0.4.1~18-2.1 on GA media","description":"These are all security issues fixed in the sccache-0.4.1~18-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:33:34.357044Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12863-1","title":"tealdeer-1.6.1-2.1 on GA media","description":"These are all security issues fixed in the tealdeer-1.6.1-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:16:23.434238Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12864-1","title":"wasm-pack-0.11.0~0-2.1 on GA media","description":"These are all security issues fixed in the wasm-pack-0.11.0~0-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:31:24.861235Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12866-1","title":"keylime-ima-policy-0.2.0+git.1681457715.54484b7-1.1 on GA media","description":"These are all security issues fixed in the keylime-ima-policy-0.2.0+git.1681457715.54484b7-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:47:09.346304Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12960-1","title":"watchexec-1.22.3-1.1 on GA media","description":"These are all security issues fixed in the watchexec-1.22.3-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:26:12.438132Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:12973-1","title":"pijul-1.0.0~beta.5-1.1 on GA media","description":"These are all security issues fixed in the pijul-1.0.0~beta.5-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:27:32.614662Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:13106-1","title":"hoard-v.1.4.2~0-1.1 on GA media","description":"These are all security issues fixed in the hoard-v.1.4.2~0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:38:53.569862Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2026:12402-1","title":"mdbook-0.5.4-1.1 on GA media","description":"These are all security issues fixed in the mdbook-0.5.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-11-03T00:00:00Z","modified":"2026-11-04T17:23:24.621105062Z","updated_at":"2026-11-04T17:43:22.558805Z"},{"id":"RUSTSEC-2023-0034","title":"Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)","description":"If an attacker is able to flood the network with pairs of `HEADERS`/`RST_STREAM` frames, such that the `h2` application is not able to accept them faster than the bytes are received, the pending accept queue can grow in memory usage. Being able to do this consistently can result in excessive memory use, and eventually trigger Out Of Memory.\n\nThis flaw is corrected in [hyperium/h2#668](https://github.com/hyperium/h2/pull/668), which restricts remote reset stream count by default.","status":"published","published":"2023-04-14T12:00:00Z","modified":"2023-11-08T04:12:03.0117Z","updated_at":"2026-11-02T15:53:39.971022Z"},{"id":"SUSE-SU-2023:2603-1","title":"Security update for rustup","description":"This update for rustup fixes the following issues:\n\n- CVE-2022-31394: Fixed possible HTTP2 attacks by specifying the HTTP/2 SETTINGS_MAX_HEADER_LIST_SIZE (bsc#1208552).\n- CVE-2023-26964: Fixed high memory and CPU usage when stream stacking occurs when H2 processes HTTP2 RST_STREAM frames (bsc#1210345).\n","status":"published","published":"2023-06-22T07:48:27Z","modified":"2026-02-04T03:47:07.033546Z","updated_at":"2026-11-02T15:53:53.019382Z"},{"id":"SUSE-SU-2025:02809-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.7+141:\n  * CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)\n    \n- Update to version 0.2.7+117:\n  * CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).\n  * CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).\n  * CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).\n  * CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).\n  * CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).\n  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)\n","status":"published","published":"2025-08-15T12:51:37Z","modified":"2026-03-23T04:49:46.369393Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02810-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.7+141:\n  * CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)\n    \n- Update to version 0.2.7+117:\n  * CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).\n  * CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).\n  * CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).\n  * CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).\n  * CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).\n  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)\n","status":"published","published":"2025-08-15T12:51:47Z","modified":"2026-03-23T04:46:48.999985Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02811-1","title":"Security update for rust-keylime","description":"This update for rust-keylime fixes the following issues:\n\n- Update to version 0.2.7+141:\n  * CVE-2025-58266: shlex: Fixed command injection (bsc#1247193)\n    \n- Update to version 0.2.7+117:\n  * CVE-2023-26964: rust-keylime: hyper,h2: stream stacking when H2 processing HTTP2 RST_STREAM frames (bsc#1210344).\n  * CVE-2024-12224: rust-keylime: idna: idna accepts Punycode labels that do not produce any non-ASCII when decoded (bsc#1243861).\n  * CVE-2024-32650: rust-keylime: rust-rustls: Infinite loop in rustls::conn::ConnectionCommon:complete_io() with proper client input (bsc#1223234).\n  * CVE-2024-43806: rust-keylime: rustix: rustix::fs::Dir iterator with the linux_raw backend can cause memory explosion (bsc#1229952).\n  * CVE-2025-3416: rust-keylime: openssl: Use-After-Free in Md::fetch and Cipher::fetch in rust-openssl crate (bsc#1242623).\n  * rust-shlex: Multiple issues involving quote API ( RUSTSEC-2024-0006, GHSA-r7qv-8r2h-pg27, bsc#1230029)\n","status":"published","published":"2025-08-15T12:51:54Z","modified":"2026-03-23T04:46:49.764211Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2026:3022-1","title":"Security update for sccache","description":"This update for sccache fixes the following issues:\n\nUpdate to version 0.15.0~17.\n\n- CVE-2023-26964: hyper,h2: high resource consumption due to stream stacking when H2 component processes\n  `HTTP2 RST_STREAM` frames (bsc#1210346).\n- CVE-2024-32650: rust-rustls: infinite loop in `rustls::conn::ConnectionCommon:complete_io()` when processing client\n  input network input (bsc#1223238).\n- CVE-2025-3416: openssl: use-after-free in `Md::fetch` and `Cipher::fetch` (bsc#1242611).\n- CVE-2026-25727: time: stack exhaustion in the RFC 2822 date parser when processing certain user provided input\n  (bsc#1257923).\n- CVE-2026-41676: openssl: short buffer overflow via `Deriver:derive` and `PkeyCtxRef:derive` when using OpenSSL 1.1.1\n  (bsc#1270206).\n- CVE-2026-41677: openssl: out-of-bounds read in PEM password callback when returning an oversized length\n  (bsc#1270559).\n- CVE-2026-41678: openssl: OOB write due to incorrect bounds assertion in `aes::unwrap_key()` (bsc#1270693).\n- CVE-2026-41681: openssl: stack corruption due to `MdCtxRef::digest_final()` writing past caller buffer with no length\n  check (bsc#1270736).\n- CVE-2026-41898: openssl: information leak to network peers due to unchecked callback-returned length in PSK and\n  cookie generate trampolines (bsc#1270869).\n- CVE-2026-42327: openssl: undefined behavior in `X509Ref::ocsp_responders` when processing certificates with non-UTF-8\n  OCSP URLs (bsc#1270512).\n- CVE-2026-44662: openssl: heap buffer overflow when encrypting with AES key-wrap-with-padding (bsc#1270938).\n- CVE-2026-45784: openssl: out-of-bounds write in `CipherCtxRef::cipher_update_inplace` for AES-KW-PAD ciphers\n  (bsc#1270948).\n","status":"published","published":"2026-07-15T09:48:47Z","modified":"2026-07-16T10:00:06.462054885Z","updated_at":"2026-11-02T15:54:04.987808Z"}]}}