CVE-2023-26964 – This vulnerability in hyper v0.13.7's h2-0.2.4 ... (How to Fix)

Q: What is the severity of CVE-2023-26964?

CVE-2023-26964 has a CVSS score of 7.5 (HIGH). This vulnerability in hyper v0.13.7's h2-0.2.4 component causes excessive memory and CPU consumption when processing HTTP/2 RST_STREAM frames, leading to denial of service. Any system using the affected hyper crate version for HTTP/2 services is vulnerable. This primarily impacts Rust applications that rely on hyper for HTTP/2 communication.

📋 TL;DR

This vulnerability in hyper v0.13.7's h2-0.2.4 component causes excessive memory and CPU consumption when processing HTTP/2 RST_STREAM frames, leading to denial of service. Any system using the affected hyper crate version for HTTP/2 services is vulnerable. This primarily impacts Rust applications that rely on hyper for HTTP/2 communication.

💻 Affected Systems

Products:

hyper (Rust HTTP library)

Versions: hyper v0.13.7 with h2-0.2.4 component

Operating Systems: All operating systems running affected Rust applications

Default Config Vulnerable: ⚠️ Yes

Notes: Only affects HTTP/2 connections; HTTP/1.x is not vulnerable. Applications must be using the h2 component within hyper.

📦 What is this software?

H2 by Hyper

View all CVEs affecting H2 →

Hyper by Hyper

View all CVEs affecting Hyper →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete service unavailability due to resource exhaustion, potentially affecting multiple services on the same host.

🟠

Likely Case

Degraded performance and intermittent service disruptions under targeted attack.

🟢

If Mitigated

Minimal impact with proper rate limiting and resource monitoring in place.

🌐 Internet-Facing: HIGH

🏢 Internal Only: MEDIUM

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: LIKELY

Unauthenticated Exploit: ⚠️ Yes

Complexity: LOW

Exploitation requires sending specially crafted HTTP/2 RST_STREAM frames, which is straightforward for attackers with network access.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: hyper v0.14.27 or later

Vendor Advisory: https://github.com/hyperium/hyper/security/advisories/GHSA-5h46-h7hh-c6x9

Restart Required: Yes

Instructions:

1. Update Cargo.toml to require hyper >=0.14.27. 2. Run 'cargo update hyper'. 3. Rebuild and redeploy your application. 4. Restart affected services.

🔧 Temporary Workarounds

Disable HTTP/2

all

Configure hyper to use only HTTP/1.x, bypassing the vulnerable h2 component

Set hyper client/server configuration to disable HTTP/2 protocol

Rate limit RST_STREAM frames

linux

Implement network-level rate limiting for HTTP/2 RST_STREAM frames

iptables -A INPUT -p tcp --dport 443 -m string --string "RST_STREAM" --algo bm -m limit --limit 10/min -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -m string --string "RST_STREAM" --algo bm -j DROP

🧯 If You Can't Patch

Implement strict network segmentation to limit access to HTTP/2 services
Deploy WAF or load balancer with HTTP/2 anomaly detection capabilities

🔍 How to Verify

Check if Vulnerable:

Check Cargo.lock for 'hyper = "0.13.7"' and 'h2 = "0.2.4"' dependencies

Check Version:

grep -A2 -B2 'hyper\|h2' Cargo.lock

Verify Fix Applied:

Verify Cargo.lock contains 'hyper >=0.14.27' and no reference to h2-0.2.4

📡 Detection & Monitoring

Log Indicators:

Spike in memory usage patterns
Unusual number of HTTP/2 connection resets
CPU saturation alerts

Network Indicators:

High volume of RST_STREAM frames from single sources
Abnormal HTTP/2 session termination patterns

SIEM Query:

source="*" ("RST_STREAM" AND "HTTP/2") | stats count by src_ip

📊 Metadata

CVE ID: CVE-2023-26964

CVSS v3 Score: 7.5 (HIGH)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-770

Published: April 11, 2023

Last Updated: February 11, 2025

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2023-26964, you might also want to check these: