Skip to content

⚔️ 0.29.3

Latest
Latest

Choose a tag to compare

View all tags
@ghedo ghedo released this 14 Jul 15:22
0.29.3
55886df

⚠️ Security:

  • Fixed unbounded PathEvent queue growth when an authenticated peer sends valid packets from rapidly changing source ports. Path events are now bounded by the configured path capacity.
  • Hardened HTTP/3 frame parsing against memory exhaustion by enforcing payload limits as soon as frame lengths are known, allocating frame buffers incrementally, and skipping unknown frame payloads without buffering them.
  • Fixed HTTP/3 field-section size enforcement to include the 32-byte per-field overhead required by RFC 9114, preventing the configured limit from being bypassed with many small fields.

Highlights:

  • h3::Config::new() now advertises and enforces a default SETTINGS_MAX_FIELD_SECTION_SIZE of 32 KiB. Applications that accept larger field sections must configure a higher limit with h3::Config::set_max_field_section_size().
  • Added h3::Config::set_max_priority_update_size() to configure the maximum PRIORITY_UPDATE frame payload size. The default is 256 bytes.
  • Connection and stream receive flow-control windows now always start at their configured initial maximum data values instead of being clamped to smaller defaults. The related Rust and C configuration setters are deprecated no-ops.
  • Fixed destination connection ID retirement when connection IDs arrive out of sequence, including associated path retirement bookkeeping.
  • Fixed PTO backoff arithmetic overflow on connections with prolonged packet loss.

Full changelog at 0.29.2...0.29.3

Assets 2
Loading