fix(0.3.x): limit excessive amount of small DATA frames (GHSA-q83h-524g-xf6h) - #948
Open
Sruhvx-jpg wants to merge 1 commit into
Open
fix(0.3.x): limit excessive amount of small DATA frames (GHSA-q83h-524g-xf6h)#948Sruhvx-jpg wants to merge 1 commit into
Sruhvx-jpg wants to merge 1 commit into
Conversation
Problem HTTP/2 flow control limits DATA payload bytes, but not the framing overhead from excessive numbers of small frames. A peer could fragment data into many tiny frames, causing disproportionate memory usage from queued events while remaining within flow-control windows. Solution Backport the framing overhead budget and empty frame handling from master (hyperium#935, hyperium#940, hyperium#942, hyperium#945, hyperium#946) to the 0.3.x maintenance branch. Validation Ran the full test suite and added regression integration tests in stream_states.rs.
Sruhvx-jpg
force-pushed
the
fix/backport-data-frame-budget-0.3
branch
from
August 23, 2026 16:14
dda1efc to
38ed858
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Overview
This is a direct 1:1 backport of @seanmonstar's fix on
masteracross PRs #935, #940, #942, #945, and #946 to the0.3.xbranch to resolve GHSA-q83h-524g-xf6h / RUSTSEC-2026-0258.No new logic has been invented; this ports the stabilized
masterimplementation (including the EOS exemption, separate empty frame accounting, and auto-scaling connection window budget) directly to0.3.xto unblock downstreamhttp 0.2consumers like Actix Web 4 (actix/actix-web#4199).Changes Backported
src/proto/streams/recv.rs). Empty frames are capped separately up toMAX_RECV_EMPTY_DATA_FRAMES(100).Budgettracking toCountsbased onDEFAULT_DATA_FRAME_OVERHEAD_THRESHOLD(256B). Small frames consume budget; large frames and consumed frames replenish it.DATAframes carryingEND_STREAMdo not consume budget as they cannot create unbounded stream overhead.(connection_window / 2).max(DEFAULT_DATA_FRAME_BUDGET)and can be configured viaBuilder::data_frame_budget.GOAWAY(ENHANCE_YOUR_CALM, "too_many_data_frames").Validation
0.3.xtest suites pass.tests/h2-tests/tests/stream_states.rs:recv_ignores_empty_data_without_end_streamtoo_many_empty_data_frames_sends_goawaytoo_many_padded_empty_data_frames_sends_goawaytoo_many_small_data_frames_sends_goaway