h2 denial of service vulnerability

[oherrala]

Open issues in affected repositories:

• Stream stacking occurs when H2 processes HTTP2 RST_STREAM frames. As a result, the memory and CPU usage are high. hyperium/hyper#2877
• GitHub security advisory - vulnerable to denial of service hyperium/h2#665

And advisories:

• https://nvd.nist.gov/vuln/detail/CVE-2023-26964
• GHSA-f8vr-r385-rh5r

[olix0r]

Note that these advisories were NOT reported through hyper's documented security process. The scope and impacted should not be trusted until maintainers have reviewed it.

[tarcieri]

See this thread for more information: hyperium/hyper#2877 (comment)

[tarcieri]

#1684 is the PR to add an advisory for this