{"id":"GHSA-q6cp-qfwq-4gcv","aliases":["RUSTSEC-2024-0332"],"status":"published","title":"h2 servers vulnerable to degradation of service with CONTINUATION Flood","description":"An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage.\n\nTokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.\n\nMore details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.\n\nPatches available for 0.4.x and 0.3.x versions.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","from":"ghsa"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-770"],"published":"2024-04-03T12:00:00Z","modified":"2026-09-10T03:49:18Z","fixes":[{"ecosystem":"crates.io","package":"h2","fixed_in":["0.3.26","0.4.4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"crates.io","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.3.26"}]}]},{"source":"ghsa","ecosystem":"crates.io","package":"h2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.4.0"},{"fixed":"0.4.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"h2","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.3.26"}]}]},{"source":"osv","ecosystem":"crates.io","package":"h2","ranges":[{"type":"SEMVER","events":[{"introduced":"0.4.0"},{"fixed":"0.4.4"}]}]},{"source":"osv","ecosystem":"crates.io","package":"h2","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.3.26"},{"introduced":"0.4.0-0"},{"fixed":"0.4.4"}]}]}],"references":[{"url":"https://rustsec.org/advisories/RUSTSEC-2024-0332.html","tags":["web","advisory"]},{"url":"https://seanmonstar.com/blog/hyper-http2-continuation-flood","tags":["web"]},{"url":"https://www.kb.cert.org/vuls/id/421644","tags":["web"]},{"url":"https://github.com/advisories/GHSA-q6cp-qfwq-4gcv"},{"url":"https://github.com/hyperium/h2","tags":["package"]},{"url":"https://crates.io/crates/h2","tags":["package"]},{"url":"https://seanmonstar.com/blog/hyper-http2-continuation-flood/","tags":["web"]}],"sources":{"ghsa":[{"id":"GHSA-q6cp-qfwq-4gcv","title":"h2 servers vulnerable to degradation of service with CONTINUATION Flood","description":"An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage.\n\nTokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.\n\nMore details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.\n\nPatches available for 0.4.x and 0.3.x versions.\n","status":"published","published":"2024-04-05T15:05:32Z","modified":"2024-04-05T15:05:33Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:37:42.744468Z"}],"osv":[{"id":"GHSA-q6cp-qfwq-4gcv","title":"h2 servers vulnerable to degradation of service with CONTINUATION Flood","description":"An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage.\n\nTokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.\n\nMore details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.\n\nPatches available for 0.4.x and 0.3.x versions.\n","status":"published","published":"2024-04-05T15:05:32Z","modified":"2026-09-10T03:49:18.784343884Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:54.055966Z"},{"id":"RUSTSEC-2024-0332","title":"Degradation of service in h2 servers with CONTINUATION Flood","description":"An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely.\nThis results in an increase in CPU usage.\n\nTokio task budget helps prevent this from a complete denial-of-service, as the server can still\nrespond to legitimate requests, albeit with increased latency.\n\nMore details at \"https://seanmonstar.com/blog/hyper-http2-continuation-flood/.\n\nPatches available for 0.4.x and 0.3.x versions.","status":"published","published":"2024-04-03T12:00:00Z","modified":"2024-04-11T16:41:43.668809Z","updated_at":"2026-11-02T15:53:39.971022Z"}]}}