RUSTSEC-2026-0258: h2 unbounded empty DATA frames

| Details | |
| --- | --- |
| Package | `h2` |
| Version | `0.4.7` |
| URL | https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h |
| Patched Versions | >=0.4.16 |
| Aliases | [GHSA-q83h-524g-xf6h](https://github.com/advisories/GHSA-q83h-524g-xf6h) |

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

Start by locating the Rust dependency manifest and lockfile entries for the h2 crate, then inspect how version 0.4.7 is selected. Done means the project resolves h2 to patched version 0.4.16 or newer and dependency checks no longer report RUSTSEC-2026-0258.

Written by the indexing model from the issue text.