Description
Hyperium Hyper before 0.14.19 does not allow for customization of the max_header_list_size method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-hyper | 0.14.19-1 | — |
| Debian 13 | rust-hyper | 0.14.19-1 | — |
| Debian 12 | rust-hyper | 0.14.19-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | gstreamer-plugins-rs | 0.8.2-150400.3.3.1 | SUSE-SU-2024:0090-1 |
| SLES 15 SP5 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
| SLES 15 SP5 | sccache | 0.4.1~18-150300.7.12.1 | SUSE-SU-2023:3526-1, SUSE-SU-2023:2637-1 |
| SLES 15 SP4 | aws-nitro-enclaves-cli | 1.2.2~git0.4ccc639-150400.3.3.1 | SUSE-SU-2023:1844-1 |
| SLES 15 SP4 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
| SLES 15 SP4 | sccache | 0.4.2~3-150400.3.3.1 | SUSE-SU-2023:3526-1 |
| SLES 15 SP3 | sccache | 0.4.1~18-150300.7.12.1 | SUSE-SU-2023:2637-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | sccache | 0.4.1~18-150300.7.12.1 | SUSE-SU-2023:2637-1 |
| SLE Real Time 15 SP4 | gstreamer-plugins-rs | 0.8.2-150400.3.3.1 | SUSE-SU-2024:0090-1 |
| SLE Real Time 15 SP3 | sccache | 0.4.1~18-150300.7.12.1 | SUSE-SU-2023:2637-1 |
| SLE HPC 15 SP3 | sccache | 0.4.1~18-150300.7.12.1 | SUSE-SU-2023:2637-1 |
| SUSE Enterprise Storage 7.1 | sccache | 0.4.1~18-150300.7.12.1 | SUSE-SU-2023:2637-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | pijul | 1.0.0~beta.4-1.1 | openSUSE-SU-2024:12764-1 |
| openSUSE Tumbleweed | rustup | 1.25.2~0-2.1 | openSUSE-SU-2024:12727-1 |
| openSUSE Tumbleweed | sccache | 0.4.0pre.7~0-2.1 | openSUSE-SU-2024:12728-1 |
| openSUSE Tumbleweed | wasm-pack | 0.11.0~0-1.1 | openSUSE-SU-2024:12807-1 |
| openSUSE Leap 15.5 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
| openSUSE Leap 15.5 | sccache | 0.4.2~3-150400.3.3.1 | SUSE-SU-2023:3526-1 |
| openSUSE Leap 15.4 | aws-nitro-enclaves-cli | 1.2.2~git0.4ccc639-150400.3.3.1 | SUSE-SU-2023:1844-1 |
| openSUSE Leap 15.4 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
| openSUSE Leap 15.4 | sccache | 0.4.2~3-150400.3.3.1 | SUSE-SU-2023:3526-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | aws-nitro-enclaves-cli +2 | 1.2.2-0.amzn2023 | ALAS2023-2023-129 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | rpm-ostree | 2022.1-7 | — |
| Azure Linux 3 | rust | hyper-0.14.25 | — |
| Azure Linux 2 (CBL-Mariner) | rpm-ostree | 2022.1-4 | — |
Advisories 10
- SUSE-SU-2024:0090-1 Security update for gstreamer-plugins-rs SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:3526-1 Security update for sccache SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2603-1 Security update for rustup SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:1844-1 Security update for aws-nitro-enclaves-cli SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12727-1 rustup-1.25.2~0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2637-1 Security update for sccache SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12764-1 pijul-1.0.0~beta.4-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12807-1 wasm-pack-0.11.0~0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12728-1 sccache-0.4.0pre.7~0-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- ALAS2023-2023-129 Important: aws-nitro-enclaves-cli security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 14, 2023