An attacker can send a flood of CONTINUATION frames, causing h2 to process them indefinitely. This results in an increase in CPU usage.

Tokio task budget helps prevent this from a complete denial-of-service, as the server can still respond to legitimate requests, albeit with increased latency.

More details at https://seanmonstar.com/blog/hyper-http2-continuation-flood/.

Patches available for 0.4.x and 0.3.x versions.

References

• https://rustsec.org/advisories/RUSTSEC-2024-0332.html
• https://seanmonstar.com/blog/hyper-http2-continuation-flood
• https://www.kb.cert.org/vuls/id/421644