GHSA-q6cp-qfwq-4gcv: h2 servers vulnerable to degradation of service with CONTINUATION Flood

April 5, 2024

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

References

github.com/advisories/GHSA-q6cp-qfwq-4gcv
github.com/hyperium/h2
rustsec.org/advisories/RUSTSEC-2024-0332.html
seanmonstar.com/blog/hyper-http2-continuation-flood
www.kb.cert.org/vuls/id/421644

Code Behaviors & Features

Detect and mitigate GHSA-q6cp-qfwq-4gcv with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →