h2 servers vulnerable to degradation of service with CONTINUATION Flood

published 2024-04-03 2y ago modified 2026-09-10 2mo ago also RUSTSEC-2024-0332

cvss: 5.3; version 3.1, GitHub
cisa kev: Not listed; not in CISA's catalog
epss: —; no score, EPSS covers CVEs only
public exploits: 0; none known

An attacker can send a flood of CONTINUATION frames, causing `h2` to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

Patch / fix

fixed in 1

crates.io h2 0.3.26, 0.4.4

Is GHSA-q6cp-qfwq-4gcv in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected packages

ecosystem	package	affected	fixed in
crates.io	h2	<0.3.26 >=0.4.0, <0.4.4 >=0.0.0-0, <0.3.26 >=0.4.0-0, <0.4.4	0.3.26 0.4.4

Classification

Weakness

CWE-400 Uncontrolled Resource Consumption
CWE-770 Allocation of Resources Without Limits or Throttling

References

github.com /hyperium/h2
package
rustsec.org /advisories/RUSTSEC-2024-0332.html
web, advisory
seanmonstar.com /blog/hyper-http2-continuation-flood
web
kb.cert.org /vuls/id/421644
web
crates.io /crates/h2
package
seanmonstar.com /blog/hyper-http2-continuation-flood/
web

Sources

GitHub Advisory GHSA-q6cp-qfwq-4gcv
OSV RUSTSEC-2024-0332

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.