An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result the memory and CPU usage are high which can lead to a Denial of Service (DoS).

🗓️ 17 May 2023 07:00:00Reported by MicrosoftType

DoS due to memory and CPU usage from HTTP2 reset stream frame handling in hyper 0.13.7 and h2 0.2.4.

Reporter	Title	Published	Views	Family All 154
Tenable Nessus	Azure Linux 3.0 Security Update: kata-containers / rpm-ostree (CVE-2023-26964)	10 Feb 202500:00	–	nessus
Tenable Nessus	Fedora 37 : clevis-pin-tpm2 / greetd / keyring-ima-signer / libkrun / etc (2023-37ae269843)	18 May 202300:00	–	nessus
Tenable Nessus	Fedora 38 : clevis-pin-tpm2 / greetd / keyring-ima-signer / libkrun / etc (2023-cc21019773)	7 May 202300:00	–	nessus
Tenable Nessus	Fedora 39 : clevis-pin-tpm2 / greetd / keyring-ima-signer / libkrun / etc (2023-d88521bfc5)	7 Nov 202300:00	–	nessus
Tenable Nessus	CBL Mariner 2.0 Security Update: kata-containers / rpm-ostree (CVE-2023-26964)	3 Jul 202400:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : kanidm (openSUSE-SU-2024:0294-1)	10 Sep 202400:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : rustup (SUSE-SU-2023:2603-1)	23 Jun 202300:00	–	nessus
Tenable Nessus	SUSE SLED15 / SLES15 Security Update : sccache (SUSE-SU-2026:3022-1)	16 Jul 202600:00	–	nessus
Tenable Nessus	Linux Distros Unpatched Vulnerability : CVE-2023-26964	30 Aug 202500:00	–	nessus
BDU FSTEC	The vulnerability of the HTTP library for Rust Hyper, related to unlimited resource distribution, allows attackers to cause service failures.	20 Jun 202300:00	–	bdu_fstec