CVE-2023-26964 h2 vulnerable to denial of service
Attackers can cause high memory and CPU usage leading to Denial of Service by sending crafted HTTP2 RST_STREAM frames to applications using the hyper library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-26964?
CVE-2023-26964 is a high-severity denial of service vulnerability in n/a, published on 11 Apr 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).
Weakness: CWE-770
Which versions are affected by CVE-2023-26964?
3 open source packages ship an affected version, including h2. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
h2 crates.io | All versions | 0.3.17 |
h2 crates.io | All versions | 0.3.17 |
h2 crates.io | From 0.0.0-0 | 0.3.17 |
Linux distribution packages (6)
hoard openSUSE:Tumbleweed | All versions | v.1.4.2~0-1.1 |
pijul openSUSE:Tumbleweed | All versions | 1.0.0~beta.5-1.1 |
rustup openSUSE:Tumbleweed | All versions | 1.25.2~0-4.1 |
sccache openSUSE:Tumbleweed | All versions | 0.4.1~18-2.1 |
wasm-pack openSUSE:Tumbleweed | All versions | 0.11.0~0-2.1 |
watchexec openSUSE:Tumbleweed | All versions | 1.22.3-1.1 |
Products include Hyper H2, Hyper Hyper.
How do I fix CVE-2023-26964?
Upgrade h2 to 0.3.17 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-26964 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-26964 exists.
Sources
Also known as AZL-26291, AZL-26730, AZL-34823, AZL-35217, AZL-61174, DEBIAN-CVE-2023-26964 and 12 more.