JLSEC-2026-20 | Vulnetix

JLSEC-2026-20 PUBLISHED CVSS 7.5 HIGH

Hyperium Hyper before 0.14.19 does not allow for customization of the `max_header_list_size` method in the H2 third-party software, allowing attackers to perform HTTP2 attacks.

Risk Scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected Products

Vendor	Product	Versions
Julia	hyper_jll	0
Julia	hyper_jll	0, 0

Timeline

Apr 1, 2026 CVE Published
Jul 25, 2026 CVE Updated

References

https://github.com/hyperium/hyper/compare/v0.14.18...v0.14.19 url
https://github.com/hyperium/hyper/issues/2826 url
https://github.com/hyperium/hyper/pull/2828 url

Open in Interactive Console →