getsentry / getsentry/sentry-cli
RUSTSEC-2026-0258: h2 unbounded empty DATA frames
- Dominant language
- Rust
- Stars
- 1k
- Forks
- 255
- Avg merge
- 5d 13h
- Merged PRs (30d)
- 8
Description
> h2 unbounded empty DATA frames
| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `h2` |
| Version | `0.4.15` |
| URL | [https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h](https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h) |
| Date | 2026-08-17 |
| Patched versions | `>=0.4.16` |
The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.
Low severity.
Patched in v0.4.16.
See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0258.html) for additional details.
Contributor guide
Assessment
This issue has not been assessed yet.