From 8cd25d7e0fe4015796bdd6c4bc88c0d459921ac7 Mon Sep 17 00:00:00 2001 From: Edouard Vanbelle Date: Fri, 21 Aug 2026 13:49:43 +0200 Subject: [PATCH] security(RUSTSEC-2026-0258): update h2 crate and ignore alert for aws dependency, risk of DoS is null with AWS/S3) --- .cargo/audit.toml | 24 ++++++++++++++++++++++++ Cargo.lock | 34 +++++++++++++++++----------------- 2 files changed, 41 insertions(+), 17 deletions(-) diff --git a/.cargo/audit.toml b/.cargo/audit.toml index 7a63df25..f27f13b1 100644 --- a/.cargo/audit.toml +++ b/.cargo/audit.toml @@ -23,6 +23,30 @@ ignore = [ "RUSTSEC-2026-0098", "RUSTSEC-2026-0099", + # h2 0.3.27 — RUSTSEC-2026-0258 "unbounded empty DATA frames" + # (GHSA-q83h-524g-xf6h). Transitive via aws-smithy-http-client 1.1.12 + # → hyper 0.14.32 → h2 0.3.27. The patched line is 0.4.16+, but hyper + # 0.14's `h2 = "0.3"` requirement pins us to the 0.3.x branch which + # will not receive a backport — real fix requires aws-smithy-http-client + # to migrate to hyper 1.x (which our other h2 copy — 0.4.16, already + # bumped — is on). The 0.4.x copy is fixed via `cargo update`; this + # ignore covers only the 0.3.x chain. + # + # Severity: low (advisory's own classification). Attack is empty-DATA- + # frame flooding by a malicious HTTP/2 peer → memory pressure or panic. + # In this codebase h2 0.3.x runs strictly on the CLIENT side of AWS + # SDK requests to S3 endpoints. Exploitation requires either + # compromising AWS S3 (out-of-scope) or MitM with a valid TLS cert + # for the configured S3 host (bigger problem than the DoS). No + # data-integrity or auth impact; panic path contained by + # request-level unwind. + # + # Un-ignore trigger: aws-smithy-http-client releases a version that + # switches to hyper 1.x (checkable with `cargo tree -i h2@0.3` — the + # command returns no rows once the chain is gone). Track upstream at + # https://github.com/smithy-lang/smithy-rs/issues (search "hyper 1"). + "RUSTSEC-2026-0258", + # instant unmaintained — transitive via azure_core 0.21.0 (latest available). # No direct security impact; no upgrade path exists. "RUSTSEC-2024-0384", diff --git a/Cargo.lock b/Cargo.lock index 2ee0cc0f..1156a1ae 100644 --- a/Cargo.lock +++ b/Cargo.lock @@ -160,7 +160,7 @@ version = "1.1.5" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "40c48f72fd53cd289104fc64099abca73db4166ad86ea0b4341abe65af83dadc" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -171,7 +171,7 @@ checksum = "291e6a250ff86cd4a820112fb8898808a366d8f9f58ce16d1f538353ad55747d" dependencies = [ "anstyle", "once_cell_polyfill", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -601,7 +601,7 @@ dependencies = [ "aws-smithy-runtime-api", "aws-smithy-types", "h2 0.3.27", - "h2 0.4.13", + "h2 0.4.16", "http 0.2.12", "http 1.4.0", "http-body 0.4.6", @@ -2267,7 +2267,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -2916,9 +2916,9 @@ dependencies = [ [[package]] name = "h2" -version = "0.4.13" +version = "0.4.16" source = "registry+https://github.com/rust-lang/crates.io-index" -checksum = "2f44da3a8150a6703ed5d34e164b875fd14c2cdab9af1252a9a1020bde2bdc54" +checksum = "a9f37a958b41b3b19ee2707c06439c0e9e547e847223eb791ecb0cb821c65e27" dependencies = [ "atomic-waker", "bytes", @@ -3197,7 +3197,7 @@ dependencies = [ "bytes", "futures-channel", "futures-core", - "h2 0.4.13", + "h2 0.4.16", "http 1.4.0", "http-body 1.0.1", "httparse", @@ -3285,7 +3285,7 @@ dependencies = [ "libc", "percent-encoding", "pin-project-lite", - "socket2 0.6.4", + "socket2 0.5.10", "tokio", "tower-service", "tracing", @@ -3603,7 +3603,7 @@ checksum = "3640c1c38b8e4e43584d8df18be5fc6b0aa314ce6ebf51b53313d4306cca8e46" dependencies = [ "hermit-abi", "libc", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -4318,7 +4318,7 @@ version = "0.50.3" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.59.0", ] [[package]] @@ -5140,7 +5140,7 @@ dependencies = [ "quinn-udp", "rustc-hash", "rustls 0.23.40", - "socket2 0.6.4", + "socket2 0.5.10", "thiserror 2.0.18", "tokio", "tracing", @@ -5177,7 +5177,7 @@ dependencies = [ "cfg_aliases", "libc", "once_cell", - "socket2 0.6.4", + "socket2 0.5.10", "tracing", "windows-sys 0.60.2", ] @@ -5651,7 +5651,7 @@ dependencies = [ "errno", "libc", "linux-raw-sys 0.12.1", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -6174,7 +6174,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "52d1cfed4120b4d927bf7c0f86d2087a4a7d6027c906d9f9d525a80573b9be51" dependencies = [ "libc", - "windows-sys 0.61.2", + "windows-sys 0.60.2", ] [[package]] @@ -6686,7 +6686,7 @@ dependencies = [ "getrandom 0.4.2", "once_cell", "rustix 1.1.4", - "windows-sys 0.61.2", + "windows-sys 0.52.0", ] [[package]] @@ -7016,7 +7016,7 @@ dependencies = [ "axum", "base64 0.22.1", "bytes", - "h2 0.4.13", + "h2 0.4.16", "http 1.4.0", "http-body 1.0.1", "http-body-util", @@ -8154,7 +8154,7 @@ version = "0.1.11" source = "registry+https://github.com/rust-lang/crates.io-index" checksum = "c2a7b1c03c876122aa43f3020e6c3c3ee5c05081c9a00739faf7503aeba10d22" dependencies = [ - "windows-sys 0.61.2", + "windows-sys 0.48.0", ] [[package]]