RUSTSEC-2026-0258: h2 unbounded empty DATA frames

> h2 unbounded empty DATA frames

| Details | |
| ------------------- | ---------------------------------------------- |
| Package | `h2` |
| Version | `0.3.27` |
| URL | [https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h](https://github.com/hyperium/hyper/security/advisories/GHSA-q83h-524g-xf6h) |
| Date | 2026-08-17 |
| Patched versions | `>=0.4.16` |

The h2 crate, used internally by hyper, had a flaw that would accept and queue empty DATA frames without limit.
If streams were not actively drained, this could lead to unbounded memory usage, or a panic if the length overflows.

Low severity.

Patched in v0.4.16.

See [advisory page](https://rustsec.org/advisories/RUSTSEC-2026-0258.html) for additional details.

Start by locating the project's Cargo manifests and lockfile, then check how the h2 crate is resolved and whether hyper supplies it transitively. Update the dependency resolution to a patched h2 version at least 0.4.16, and run the project's existing test suite to confirm the Rust services and libraries still build and pass.

Written by the indexing model from the issue text.