AIKIDO-2026-241554
h2 is vulnerable to Denial of Service (DoS)
25
Low Risk
This Affects:
h2TL;DR
The h2 HTTP/2 stack accepts and queues empty DATA frames without a cap. HTTP/2 flow control bounds payload bytes, not the number of frames, so a peer can fragment traffic into many empty frames and force unbounded queue growth, or a panic if the length overflows, when streams are not drained. The fix adds a connection-level budget for DATA framing overhead, discards non-final empty DATA frames after flow-control accounting, and closes the connection with ENHANCE_YOUR_CALM when that budget is exhausted.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and your application uses HTTP/2 via h2 (as a server or client) without fully draining incoming request or response bodies, for example a proxy applying backpressure or a client that delays reading the body.
Background info
h2 is vulnerable to Denial of Service (DoS) in versions 0.1.0 - 0.4.15.
How to fix this
Upgrade the h2 library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant