Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

hyperium/hyper

              master @ 08c3416
            

Fixes

CVEs

CRITICAL

Peak severity

42.9%

Coverage

Highlights

Denial of Service: 8 prior fixes. Scrutinize any change in this area.

src/proto/h2/server.rs: most-fixed (2 issues). Treat as high-risk during review.

4 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Establishing a connection but withholding the initial header bytes could completely bypass the read timeout timer, leaving the connection open indefinitely and enabling classic Slowloris attacks. Initiating the timeout immediately upon connection establishment mitigates this.

Denial of Service: A default configuration error left HTTP/2 rapid reset stream protections disabled, exposing servers to rapid-fire stream reset-based resource exhaustion attacks.

Denial of Service: Pausing downstream reads during an HTTP/2 CONNECT tunnel can bypass normal backpressure mechanics, causing unbounded buffering in memory and leading to Out-Of-Memory (OOM) crashes.