Uncontrolled Resource Consumption Affecting h2 package, versions <0.3.24 >=0.4.0 <0.4.2
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUST-H2-6182930
- published 21 Jan 2024
- disclosed 19 Jan 2024
- credit Unknown
How to fix?
Upgrade h2 to version 0.3.24, 0.4.2 or higher.
Overview
Affected versions of this package are vulnerable to Uncontrolled Resource Consumption via a steady stream of invalid frames that force the generation of reset frames on the victim endpoint. An attacker can cause Out Of Memory (OOM) and high CPU usage by closing their recv window, which then forces these resets to be queued without bounds.
References
CVSS Scores
version 3.1