-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| h2 | rust | < 0.3.24 | 0.3.24 |
| h2 | rust | >= 0.4.0, < 0.4.2 | 0.4.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stemmed from missing error reset limits in two key areas: 1) The stream reset handler (reset_on_recv_stream_err) generated resets without constraints. 2) The error counter (inc_num_local_error_resets) lacked limit enforcement. The patch added max_local_error_reset_streams configuration and checks in these functions, confirming their central role in the vulnerability. The commit diff shows these functions were modified to add the limiting logic, indicating they were previously unlimited.