You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
fix(http2): pass proper value to h2 max_local_error_reset_streams
The patch #3528 added the ability for hyper users to configure
`max_local_error_reset_streams` via the server builder to hyper
v0.14.29. It was then pulled in to hyper v1.2.0 as well in #3530, where
the wrong parameter `max_pending_accept_reset_streams` is passed to h2's
builder as `max_local_error_reset_streams`.
This could lead to significant impact especially when a hyper user does
not set `max_pending_accept_reset_streams`, because its default value is
`None` and passing `None` to h2's `max_local_error_reset_streams` method
will make the server vulnerable to DOS attacks.
This issue has been fixed in this patch, simply by passing the correct
value to the h2's builder method.
0 commit comments