{"affected":[{"database_specific":{"categories":["denial-of-service"],"cvss":null,"informational":null,"source":"https://github.com/rustsec/advisory-db/blob/osv/crates/RUSTSEC-2026-0258.json"},"ecosystem_specific":{"affected_functions":null,"affects":{"arch":[],"functions":[],"os":[]}},"package":{"ecosystem":"crates.io","name":"h2","purl":"pkg:cargo/h2"},"ranges":[{"events":[{"introduced":"0.0.0-0"},{"fixed":"0.4.16"}],"type":"SEMVER"}]}],"aliases":["GHSA-q83h-524g-xf6h"],"database_specific":{"license":"CC0-1.0"},"details":"The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.\nIf streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.\n\nLow severity.\n\nPatched in v0.4.16.","id":"RUSTSEC-2026-0258","modified":"2026-10-12T18:00:10.934581734Z","published":"2026-08-17T12:00:00Z","references":[{"type":"PACKAGE","url":"https://crates.io/crates/h2"},{"type":"ADVISORY","url":"https://rustsec.org/advisories/RUSTSEC-2026-0258.html"},{"type":"WEB","url":"https://github.com/hyperium/h2/pull/935"}],"schema_version":"1.9.0","summary":"h2 unbounded empty DATA frames"}