Stream: git-wasmtime

Topic: wasmtime / issue #14153 RUSTSEC-2026-0258: h2 unbounded e...

view this post on Zulip Wasmtime GitHub notifications bot (Aug 19 2026 at 00:07):

github-actions[bot] opened issue #14153:

h2 unbounded empty DATA frames

Details
Package h2
Version 0.4.13
URL https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
Date 2026-08-17
Patched versions >=0.4.16

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

See advisory page for additional details.

view this post on Zulip Wasmtime GitHub notifications bot (Aug 19 2026 at 15:39):

fitzgen closed issue #14153:

h2 unbounded empty DATA frames

Details
Package h2
Version 0.4.13
URL https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h
Date 2026-08-17
Patched versions >=0.4.16

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

See advisory page for additional details.

Last updated: Aug 30 2026 at 10:08 UTC