CVE catalog
CVE-2023-26964
rust-h2: CVE-2023-26964
- Severity
- Medium · CVSS 4.7
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.12% · Oct 27, 2026
An issue was discovered in hyper v0.13.7. h2-0.2.4 Stream stacking occurs when the H2 component processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high which can lead to a Denial of Service (DoS).
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rust-h2 | sid | 0.4.20-1 | fixed |
| Debian | rust-h2 | forky | 0.4.20-1 | fixed |
| Debian | rust-h2 | trixie | 0.4.7-3 | fixed |
| Debian | rust-h2 | bookworm | 0.3.13-2 | fixed |
| Suse | sccache | linux enterprise module for development tools 15 sp7 | 0.16.0~0-150600.10.11.1 | fixed |
| Suse | sccache | linux enterprise server 15 sp6-ltss | 0.16.0~0-150600.10.11.1 | fixed |
| Suse | sccache | linux enterprise server for sap applications 15 sp6 | 0.16.0~0-150600.10.11.1 | fixed |
| Suse | rust-keylime | linux enterprise micro 5.3 | 0.2.7+141-150400.3.7.1 | fixed |
| Suse | rust-keylime | linux enterprise micro 5.5 | 0.2.7+141-150500.3.5.1 | fixed |
| Suse | rust-keylime | linux enterprise micro 5.4 | 0.2.7+141-150400.3.5.1 | fixed |
| Opensuse | hoard | tumbleweed | v.1.4.2~0-1.1 | fixed |
| Opensuse | sccache | tumbleweed | 0.4.1~18-2.1 | fixed |
| Opensuse | pijul | tumbleweed | 1.0.0~beta.5-1.1 | fixed |
| Opensuse | rustup | tumbleweed | 1.25.2~0-4.1 | fixed |
| Opensuse | wasm-pack | tumbleweed | 0.11.0~0-2.1 | fixed |
| Opensuse | watchexec | tumbleweed | 1.22.3-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rust-h2 | source | sid | 0.3.13-2 | not yet assigned | Not reported | [1034723] |
| Debian | rust-h2 | source | forky | 0.3.13-2 | not yet assigned | Not reported | [1034723] |
| Debian | rust-h2 | source | trixie | 0.3.13-2 | not yet assigned | Not reported | [1034723] |
| Debian | rust-h2 | source | bookworm | 0.3.13-2 | not yet assigned | Not reported | [1034723] |
| Suse | sccache | rpm | linux enterprise module for development tools 15 sp7 | 0.16.0~0-150600.10.11.1 | Not reported | SUSE-SU-2026:3022-1 | Not reported |
| Suse | sccache | rpm | linux enterprise server 15 sp6-ltss | 0.16.0~0-150600.10.11.1 | Not reported | SUSE-SU-2026:3022-1 | Not reported |
| Suse | sccache | rpm | linux enterprise server for sap applications 15 sp6 | 0.16.0~0-150600.10.11.1 | Not reported | SUSE-SU-2026:3022-1 | Not reported |
| Suse | rust-keylime | rpm | linux enterprise micro 5.3 | 0.2.7+141-150400.3.7.1 | Not reported | SUSE-SU-2025:02809-1 | Not reported |
| Suse | rust-keylime | rpm | linux enterprise micro 5.5 | 0.2.7+141-150500.3.5.1 | Not reported | SUSE-SU-2025:02811-1 | Not reported |
| Suse | rust-keylime | rpm | linux enterprise micro 5.4 | 0.2.7+141-150400.3.5.1 | Not reported | SUSE-SU-2025:02810-1 | Not reported |
| Opensuse | hoard | rpm | tumbleweed | v.1.4.2~0-1.1 | Not reported | OPENSUSE-SU-2024:13106-1 | Not reported |
| Opensuse | sccache | rpm | tumbleweed | 0.4.1~18-2.1 | Not reported | OPENSUSE-SU-2024:12862-1 | Not reported |
| Opensuse | pijul | rpm | tumbleweed | 1.0.0~beta.5-1.1 | Not reported | OPENSUSE-SU-2024:12973-1 | Not reported |
| Opensuse | rustup | rpm | tumbleweed | 1.25.2~0-4.1 | Not reported | OPENSUSE-SU-2024:12861-1 | Not reported |
| Opensuse | wasm-pack | rpm | tumbleweed | 0.11.0~0-2.1 | Not reported | OPENSUSE-SU-2024:12864-1 | Not reported |
| Opensuse | watchexec | rpm | tumbleweed | 1.22.3-1.1 | Not reported | OPENSUSE-SU-2024:12960-1 | Not reported |
Notes
[bookworm] rust-h2: Minor issue
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [pijul-bash-completion]Unknown
Source package: [pijul]
Details (1)
1.0.0~beta.9-1.7· noarch · tumbleweedUnknown · Fixed:
1.0.0~beta.5-1.1Version impact unknown
dsa · pijul · opensuse · tumbleweed
- [pijul-fish-completion]Unknown
Source package: [pijul]
Details (1)
1.0.0~beta.9-1.7· noarch · tumbleweedUnknown · Fixed:
1.0.0~beta.5-1.1Version impact unknown
dsa · pijul · opensuse · tumbleweed
- [pijul-zsh-completion]Unknown
Source package: [pijul]
Details (1)
1.0.0~beta.9-1.7· noarch · tumbleweedUnknown · Fixed:
1.0.0~beta.5-1.1Version impact unknown
dsa · pijul · opensuse · tumbleweed
- [pijul]Fixed
Source package: [pijul]
Details (1)
1.0.0~beta.9-1.7· x86_64 · tumbleweedFixed · Fixed:
1.0.0~beta.5-1.1dsa · pijul · opensuse · tumbleweed
- [rustup]Fixed
Source package: [rustup]
Details (1)
1.29.0~0-1.1· x86_64 · tumbleweedFixed · Fixed:
1.25.2~0-4.1dsa · rustup · opensuse · tumbleweed
- [sccache]Fixed
Source package: [sccache]
Details (1)
0.17.0~1-2.1· x86_64 · tumbleweedFixed · Fixed:
0.4.1~18-2.1dsa · sccache · opensuse · tumbleweed
- [wasm-pack]Fixed
Source package: [wasm-pack]
Details (1)
0.13.1-1.6· x86_64 · tumbleweedFixed · Fixed:
0.11.0~0-2.1dsa · wasm-pack · opensuse · tumbleweed
- [watchexec]Fixed
Source package: [watchexec]
Details (1)
2.5.1-1.3· x86_64 · tumbleweedFixed · Fixed:
1.22.3-1.1dsa · watchexec · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [librust-h2-dev]Fixed
Source package: [rust-h2]
Details (2)
0.3.13-2· amd64 · bookwormFixed · Fixed:
0.3.13-2dsa · rust-h2 · debian · bookworm; dsa · rust-h2 · debian · 12
0.3.13-2· arm64 · bookwormFixed · Fixed:
0.3.13-2dsa · rust-h2 · debian · bookworm; dsa · rust-h2 · debian · 12
[Debian 13 (Trixie)]
- [librust-h2-dev]Fixed
Source package: [rust-h2]
Details (2)
0.4.7-3· amd64 · trixieFixed · Fixed:
0.3.13-2dsa · rust-h2 · debian · 13
0.4.7-3· arm64 · trixieFixed · Fixed:
0.3.13-2dsa · rust-h2 · debian · 13
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/suse-su-2026_3022-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2023-26964]
- [https://osv.dev/vulnerability/SUSE-SU-2025:02809-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:02810-1]
- [https://osv.dev/vulnerability/SUSE-SU-2025:02811-1]
- [https://osv.dev/vulnerability/SUSE-SU-2026:3022-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12861-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12862-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12864-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12960-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:12973-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2024:13106-1]
- [https://security-tracker.debian.org/tracker/CVE-2023-26964]
- [https://security.access.redhat.com/data/csaf/v2/vex/2023/cve-2023-26964.json]
[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]