Description
An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rust-h2 | 0.3.13-2 | — |
| Debian 13 | rust-h2 | 0.3.13-2 | — |
| Debian 12 | rust-h2 | 0.3.13-2 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | rust-hyper | No fix yet | — |
| Ubuntu 26.04 LTS | rust-hyper | No fix yet | — |
| Ubuntu 25.10 | rust-hyper | No fix yet | — |
| Ubuntu 24.04 LTS | rust-hyper | No fix yet | — |
| Ubuntu 20.04 LTS | rust-hyper | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | sccache | 0.16.0~0-150600.10.11.1 | SUSE-SU-2026:3022-1 |
| SLES 15 SP6 | sccache | 0.16.0~0-150600.10.11.1 | SUSE-SU-2026:3022-1 |
| SLES 15 SP5 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
| SLES 15 SP4 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP6 | sccache | 0.16.0~0-150600.10.11.1 | SUSE-SU-2026:3022-1 |
| SLE Micro 5.5 | rust-keylime | 0.2.7+141-150500.3.5.1 | SUSE-SU-2025:02811-1 |
| SLE Micro 5.4 | rust-keylime | 0.2.7+141-150400.3.5.1 | SUSE-SU-2025:02810-1 |
| SLE Micro 5.3 | rust-keylime | 0.2.7+141-150400.3.7.1 | SUSE-SU-2025:02809-1 |
| SUSE Package Hub 15 SP6 | kanidm | 1.3.3~git0.f075d13-bp156.4.1 | openSUSE-SU-2024:0294-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | hoard | v.1.4.2~0-1.1 | openSUSE-SU-2024:13106-1 |
| openSUSE Tumbleweed | mdbook | 0.5.4-1.1 | openSUSE-SU-2026:12402-1 |
| openSUSE Tumbleweed | pijul | 1.0.0~beta.5-1.1 | openSUSE-SU-2024:12973-1 |
| openSUSE Tumbleweed | rustup | 1.25.2~0-4.1 | openSUSE-SU-2024:12861-1 |
| openSUSE Tumbleweed | sccache | 0.4.1~18-2.1 | openSUSE-SU-2024:12862-1 |
| openSUSE Tumbleweed | wasm-pack | 0.11.0~0-2.1 | openSUSE-SU-2024:12864-1 |
| openSUSE Tumbleweed | watchexec | 1.22.3-1.1 | openSUSE-SU-2024:12960-1 |
| openSUSE Leap 15.6 | kanidm | 1.3.3~git0.f075d13-bp156.4.1 | openSUSE-SU-2024:0294-1 |
| openSUSE Leap 15.5 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
| openSUSE Leap 15.4 | rustup | 1.26.0~0-150400.3.7.1 | SUSE-SU-2023:2603-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kata-containers | 3.2.0.azl0-2 | — |
| Azure Linux 3 | rpm-ostree | 2024.4-1 | — |
| Azure Linux 3 | rust | h2-0.3.26 | — |
| Azure Linux 2 (CBL-Mariner) | kata-containers | 3.2.0.azl0-1 | — |
| Azure Linux 2 (CBL-Mariner) | rpm-ostree | 2022.1-7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| crates.io | h2 | < 0.3.17 | 0.3.17 | GHSA-f8vr-r385-rh5r |
| crates.io | h2 | >= 0.0.0-0, < 0.3.17 | 0.3.17 | RUSTSEC-2023-0034 |
Advisories 13
- openSUSE-SU-2026:12402-1 mdbook-0.5.4-1.1 on GA media SUSE / openSUSE Security Updates · Nov 4, 2026
- SUSE-SU-2026:3022-1 Security update for sccache SUSE / openSUSE Security Updates · Jul 16, 2026
- SUSE-SU-2025:02809-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02811-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02810-1 Security update for rust-keylime SUSE / openSUSE Security Updates · Mar 23, 2026
- openSUSE-SU-2024:13106-1 hoard-v.1.4.2~0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12862-1 sccache-0.4.1~18-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12973-1 pijul-1.0.0~beta.5-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12861-1 rustup-1.25.2~0-4.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2023:2603-1 Security update for rustup SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12864-1 wasm-pack-0.11.0~0-2.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12960-1 watchexec-1.22.3-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:0294-1 Security update for kanidm SUSE / openSUSE Security Updates · Feb 4, 2026
References
- https://github.com/hyperium/hyper/issues/2877
- FEDORA-2023-cc21019773 vendor-advisory
- FEDORA-2023-37ae269843 vendor-advisory