GHSA-q6cp-qfwq-4gcv h2 servers vulnerable to degradation of service with CONTINUATION Flood
An attacker can cause high CPU usage and service degradation by flooding h2 servers with CONTINUATION frames, impacting availability.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-q6cp-qfwq-4gcv?
GHSA-q6cp-qfwq-4gcv is a denial of service vulnerability in h2, published on 3 Apr 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage.
Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.
More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.
Patches available for 0.4.x and 0.3.x versions.
Which versions are affected by GHSA-q6cp-qfwq-4gcv?
5 open source packages ship an affected version, including h2.
| Package | Affected | Fixed in |
|---|---|---|
h2 crates.io | All versions | 0.3.26 |
h2 crates.io | All versions | 0.3.26 |
h2 crates.io | From 0.0.0-0 | 0.3.26, 0.4.4 |
h2 crates.io | From 0.4.0 | 0.4.4 |
h2 crates.io | From 0.4.0 | 0.4.4 |
How do I fix GHSA-q6cp-qfwq-4gcv?
Upgrade h2 to a fixed version for your release line: 0.3.26 or 0.4.4.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-q6cp-qfwq-4gcv being exploited?
There is no known exploitation of GHSA-q6cp-qfwq-4gcv in the wild and no public exploit code.
Sources
Also known as RUSTSEC-2024-0332.