GHSA-q6cp-qfwq-4gcv

Source

https://github.com/advisories/GHSA-q6cp-qfwq-4gcv

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/04/GHSA-q6cp-qfwq-4gcv/GHSA-q6cp-qfwq-4gcv.json

Aliases

• RUSTSEC-2024-0332

Published

2024-04-05T15:05:32Z

Modified

2024-04-11T16:41:43.668809Z

Details

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

References

• https://github.com/hyperium/h2
• https://rustsec.org/advisories/RUSTSEC-2024-0332.html
• https://seanmonstar.com/blog/hyper-http2-continuation-flood
• https://www.kb.cert.org/vuls/id/421644