VulnerableCode Package Details - pkg:deb/debian/rust-h2@0.3.13-2?distro=trixie

Search for packages

Vulnerability	Summary	Fixed by
VCID-n66u-b73u-zucb Aliases: CVE-2019-9514 GHSA-39qc-96h7-956f	golang.org/x/net/http vulnerable to a reset flood Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2	0.3.24-1 Affected by 0 other vulnerabilities. 0.4.7-3 Affected by 0 other vulnerabilities. 0.4.13-1 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-n66u-b73u-zucb
Aliases:
CVE-2019-9514
GHSA-39qc-96h7-956f

golang.org/x/net/http vulnerable to a reset flood Some HTTP/2 implementations are vulnerable to a reset flood, potentially leading to a denial of service. Servers that accept direct connections from untrusted clients could be remotely made to allocate an unlimited amount of memory, until the program crashes. The attacker opens a number of streams and sends an invalid request over each stream that should solicit a stream of RST_STREAM frames from the peer. Depending on how the peer queues the RST_STREAM frames, this can consume excess memory, CPU, or both. ### Specific Go Packages Affected golang.org/x/net/http2

0.3.24-1
Affected by 0 other vulnerabilities.

0.4.7-3
Affected by 0 other vulnerabilities.

0.4.13-1
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
VCID-mt5t-ymhy-xuhp	h2 vulnerable to denial of service Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). This issue affects users only when dealing with http2 connections.	CVE-2023-26964 GHSA-f8vr-r385-rh5r

Vulnerability

Summary

Aliases

VCID-mt5t-ymhy-xuhp

h2 vulnerable to denial of service Hyper is an HTTP library for Rust and h2 is an HTTP 2.0 client & server implementation for Rust. An issue was discovered in h2 v0.2.4 when processing header frames. It incorrectly processes the HTTP2 `RST_STREAM` frames by not always releasing the memory immediately upon receiving the reset frame, leading to stream stacking. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS). This issue affects users only when dealing with http2 connections.

CVE-2023-26964
GHSA-f8vr-r385-rh5r

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T10:06:30.927177+00:00	Debian Importer	Fixing	VCID-mt5t-ymhy-xuhp	https://security-tracker.debian.org/tracker/data/json	38.4.0
2026-04-13T06:47:12.088894+00:00	Debian Importer	Fixing	VCID-mt5t-ymhy-xuhp	https://security-tracker.debian.org/tracker/data/json	38.3.0
2026-04-03T07:52:29.490438+00:00	Debian Importer	Fixing	VCID-mt5t-ymhy-xuhp	https://security-tracker.debian.org/tracker/data/json	38.1.0
2026-04-03T07:52:29.445075+00:00	Debian Importer	Affected by	VCID-n66u-b73u-zucb	https://security-tracker.debian.org/tracker/data/json	38.1.0