RUSTSEC-2024-0332: Degradation of service in h2 servers with CONTINUATION Flood #6
Description
Degradation of service in h2 servers with CONTINUATION Flood
| Details | |
|---|---|
| Package | h2 |
| Version | 0.2.7 |
| Date | 2024-04-03 |
| Patched versions | ^0.3.26,>=0.4.4 |
An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely.
This results in an increase in CPU usage.
Tokio task budget helps prevent this from a complete denial-of-service, as the server can still
respond to legitimate requests, albeit with increased latency.
More details at "https://seanmonstar.com/blog/hyper-http2-continuation-flood/.
Patches available for 0.4.x and 0.3.x versions.
See advisory page for additional details.