{"id":"RUSTSEC-2026-0258","aliases":["GHSA-q83h-524g-xf6h"],"title":"h2 unbounded empty DATA frames","summary":"h2 unbounded empty DATA frames","severity":"none","vendor":"h2","product":"h2","ecosystem":"rust","affected":["h2 >= 0.0.0-0, < 0.4.16"],"patched":["h2 0.4.16"],"published":"2026-08-17","updated":"2026-08-18","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/RUSTSEC-2026-0258","references":[{"url":"https://crates.io/crates/h2"},{"url":"https://rustsec.org/advisories/RUSTSEC-2026-0258.html"},{"url":"https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h"}],"tags":["osv","rust"],"ingestedAt":"2026-08-18T12:28:12.047Z","slug":"RUSTSEC-2026-0258","body":"## Overview\n\nThe h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.\nIf streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.\n\nLow severity.\n\nPatched in v0.4.16.\n\n## Affected packages\n\n- `h2 >= 0.0.0-0, < 0.4.16`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `h2 0.4.16`","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}