Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hyperium/h2

              master @ 21211d0
            

Fixes

CVEs

HIGH

Peak severity

11.1%

Coverage

Highlights

Denial of Service: 11 prior fixes. Scrutinize any change in this area.

src/proto/streams/streams.rs: most-fixed (3 issues). Treat as high-risk during review.

3 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Remote attackers can cause memory exhaustion by opening and immediately resetting a large number of streams. If the application does not accept them, these streams accumulate indefinitely unless explicitly capped and rejected with ENHANCE_YOUR_CALM.

Denial of Service: Improperly tracking flow control window capacity when handling padded DATA frames on closed, GOAWAY-rejected, or erroneous streams can leak flow control window credits, permanently stalling the entire HTTP/2 connection.

Denial of Service: Parsing HTTP/2 headers without enforcing strict capacity limits on unique header fields allows remote clients to exceed underlying map capacities, causing an unhandled panic and immediate service crash.