{"id":"GHSA-q83h-524g-xf6h","aliases":["RUSTSEC-2026-0258"],"status":"published","title":"h2 unbounded empty DATA frames","description":"The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.\nIf streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.\n\nLow severity.\n\nPatched in v0.4.16.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2026-08-17T12:00:00Z","modified":"2026-10-12T18:00:10Z","fixes":[{"ecosystem":"crates.io","package":"h2","fixed_in":["0.4.16"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"crates.io","package":"h2","ranges":[{"type":"SEMVER","events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.16"}]}]}],"references":[{"url":"https://crates.io/crates/h2","tags":["package"]},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0258.html","tags":["advisory"]},{"url":"https://github.com/hyperium/h2/pull/935","tags":["web"]}],"sources":{"osv":[{"id":"RUSTSEC-2026-0258","title":"h2 unbounded empty DATA frames","description":"The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.\nIf streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.\n\nLow severity.\n\nPatched in v0.4.16.","status":"published","published":"2026-08-17T12:00:00Z","modified":"2026-10-12T18:00:10.934581734Z","updated_at":"2026-11-02T15:53:40.430679Z"}]}}