Most recent entries from all

bdu:2023-03248

EUVD-2026-214628

fkie_cve-2023-26964

An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).

GHSA-f8vr-r385-rh5r — h2 vulnerable to denial of service

Affected: crates.io: h2

Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).

This issue affects users only when dealing with http2 connections.

gsd-2023-26964

msrc_CVE-2023-26964 — An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STR…

msrc_CVE-2023-26964

openSUSE-SU-2024:0294-1 — Security update for kanidm

Security update for kanidm

RUSTSEC-2023-0034 — Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)

Affected: crates.io: h2

If an attacker is able to flood the network with pairs of `HEADERS`/`RST_STREAM` frames, such that the `h2` application is not able to accept them faster than the bytes are received, the pending accept queue can grow in memory usage. Being able to do this consistently can result in excessive memory use, and eventually trigger Out Of Memory.

This flaw is corrected in [hyperium/h2#668](https://github.com/hyperium/h2/pull/668), which restricts remote reset stream count by default.

SUSE-SU-2025:02809-1 — Security update for rust-keylime

Security update for rust-keylime

UBUNTU-CVE-2023-26964

Affected: Ubuntu:20.04:LTS: rust-hyper, Ubuntu:24.04:LTS: rust-hyper, Ubuntu:25.10: rust-hyper, Ubuntu:26.04:LTS: rust-hyper