RUSTSEC-2026-0258: h2 unbounded empty DATA frames

> h2 unbounded empty DATA frames

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `h2` |
| Version | `0.4.13` |
| URL | [https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h](https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h) |
| Date | 2026-08-17 |
| Patched versions | `>=0.4.16` |

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0258.html) for additional details.

Start by locating the Cargo manifest and lockfile entries for the h2 crate and check the resolved version. Update the dependency to a patched version at or above 0.4.16, then run the repository's existing Rust checks. Done means the project resolves the patched h2 release without introducing dependency conflicts.

Written by the indexing model from the issue text.