RUSTSEC-2026-0258 h2 unbounded empty DATA frames
Attackers can cause denial of service via unbounded memory usage or panics by sending excessive empty HTTP/2 DATA frames to applications using the h2 crate.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is RUSTSEC-2026-0258?
RUSTSEC-2026-0258 is a denial of service vulnerability in h2, published on 17 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit. If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
Which versions are affected by RUSTSEC-2026-0258?
1 open source package ship an affected version, including h2.
| Package | Affected | Fixed in |
|---|---|---|
h2 crates.io | From 0.0.0-0 | 0.4.16 |
How do I fix RUSTSEC-2026-0258?
Upgrade h2 to 0.4.16 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is RUSTSEC-2026-0258 being exploited?
There is no known exploitation of RUSTSEC-2026-0258 in the wild and no public exploit code.
Sources
Also known as GHSA-q83h-524g-xf6h.