RUSTSEC-2024-0332: Degradation of service in h2 servers with CONTINUATION Flood

What to do

1. See which version you have: cargo tree -i h2 (it also shows which of your dependencies pulls it in).
2. Update within your version requirement: cargo update -p h2. If the fix is a newer major or minor than your requirement allows, raise it in Cargo.toml (for example h2 = "0.4.4") or update the dependency that pulls it in.
3. Check again with cargo audit, or paste your Cargo.lock into our Cargo.toml checker.

Details from the advisory

An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at "https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

References

• Package: crates.io/crates/h2
• Advisory: rustsec.org/advisories/RUSTSEC-2024-0332.html
• Web: seanmonstar.com/blog/hyper-http2-continuation-flood/

From the RustSec Advisory Database (CC0-1.0) via the OSV export, downloaded Oct 24, 2026. Severity score computed from the published CVSS vector.

Other advisories for h2

• VulnerabilityRUSTSEC-2023-0034 · 2023-04-14Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
• VulnerabilityRUSTSEC-2024-0003 · 2024-01-17Resource exhaustion vulnerability in h2 may lead to Denial of Service (DoS)
• VulnerabilityRUSTSEC-2026-0258 · 2026-08-17h2 unbounded empty DATA frames

Full security history of h2