---
id: RUSTSEC-2026-0258
aliases:
  - GHSA-q83h-524g-xf6h
title: h2 unbounded empty DATA frames
summary: h2 unbounded empty DATA frames
severity: none
vendor: h2
product: h2
ecosystem: rust
affected:
  - 'h2 >= 0.0.0-0, < 0.4.16'
patched:
  - h2 0.4.16
published: '2026-08-17'
updated: '2026-08-18'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/RUSTSEC-2026-0258'
references:
  - url: 'https://crates.io/crates/h2'
  - url: 'https://rustsec.org/advisories/RUSTSEC-2026-0258.html'
  - url: 'https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h'
tags:
  - osv
  - rust
ingestedAt: '2026-08-18T12:28:12.047Z'
---

## Overview

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

## Affected packages

- `h2 >= 0.0.0-0, < 0.4.16`

## Remediation

Upgrade to a patched release:

- `h2 0.4.16`