Edit ndaal-sa-2026-434

Document Metadata

Tracking ID *

Title *

Category *

Status *

Document Version *

TLP 2.0 *

Verschlusssache

NATO

Initial Release Date *

Current Release Date *

Summary *

Publisher

Name *

Namespace *

Category *

Contact details

Affected Product

Vendor *

Product Name *

Product ID *

Product Status *

Vulnerability

Required for Security Advisories, optional for Informational / VEX.

CVE ID

Vulnerability Title

Vulnerability Description

RUSTSEC-2026-0258 (2026-08-17, alias GHSA-q83h-524g-xf6h) records the upstream flaw in the h2 crate: empty DATA frames were accepted and queued with no cap. The viewer does not implement HTTP/2 framing itself; it inherits the defect from hyper, which depends on h2 for its HTTP/2 support, and the viewer's TCP listener negotiates h2 via ALPN by default. The affected range was established by reading the lockfiles the releases actually shipped rather than assumed: v1.6.50, v1.6.52 and v1.6.53 each pin h2 0.4.15. Upstream publishes NO CVSS vector for this advisory -- it states 'Low severity' in prose only -- so the vectors here are derived and the reasoning is recorded in the generator: network-reachable (AV:N) with no credentials or interaction (PR:N/UI:N), but high attack complexity (AC:H) because the flaw only manifests when streams are not actively drained, a usage condition the attacker does not control. Data is neither disclosed nor altered (C:N/I:N); the impact is availability alone (A:L). CVSS 3.1 scores that 3.7 LOW, agreeing with upstream. CVSS 4.0 scores the same shape 6.3 MEDIUM because 4.0 weights availability-only denial of service more heavily; both figures are published rather than reconciled to one. Mapped to CWE-770 (Allocation of Resources Without Limits or Throttling), which is the precise defect class and a permitted mapping target. Threat model W-D1 ('Request flooding exhausts connections or CPU') is the row this falls under; the pre-existing mitigations there -- loopback-only default bind, the concurrency permit, and body size caps -- bound a flooding attack but do NOT bound per-stream frame queueing inside the HTTP/2 implementation, which is why the dependency bump was required rather than a configuration change.

CWE ID

CWE Name

CVSS v3.1

Base Score (0.0 – 10.0)

Severity

CVSS v3.1 Vector

CVSS v4.0

Base Score (0.0 – 10.0)

Severity

CVSS v4.0 Vector

Cancel