CVE-2023-26964: High severity hyper H2 Rust vulnerability
An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RSTSTREAM frames. As a result the memory and CPU usage are high which can lead to a Denial of Service (DoS).
Other sources
An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RSTSTREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).
— MITRE
Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 RSTSTREAM frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).
This issue affects users only when dealing with http2 connections.
— GitHub
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID of this issue in Hyper and H2?
The vulnerability ID of this issue in Hyper and H2 is CVE-2023-26964.
What is the affected software version of Hyper H2?
The affected software version of Hyper H2 is 0.2.4.
What is the affected software version of Hyper Hyper?
The affected software version of Hyper Hyper is 0.13.7.
What is the severity of CVE-2023-26964?
The severity of CVE-2023-26964 is high.
How can this vulnerability be exploited?
This vulnerability can be exploited by sending malicious HTTP2 RST_STREAM frames, causing high memory and CPU usage.