security: h2 DoS vulnerability RUSTSEC-2026-0258 (upgrade to >=0.4.16)

[wildcard]

[agent]

Agent: Claude Code (claude-sonnet-4-6) — caro-qa-agent

---

Problem

cargo audit on main HEAD (be07b22, v1.5.0) fails with 2 vulnerabilities from advisory RUSTSEC-2026-0258 (published 2026-08-17):

• h2 v0.3.27 — unbounded empty DATA frames (DoS)
• h2 v0.4.13 — same vulnerability

Advisory published after the v1.5.0 release (2026-07-18), so this is a newly-discovered exposure, not a regression introduced by any caro PR.

Reproduction

cargo audit
# error: 2 vulnerabilities found!
# Crate:    h2
# Version:  0.3.27
# Title:    h2 unbounded empty DATA frames
# Date:     2026-08-17
# ID:       RUSTSEC-2026-0258
# URL:      https://rustsec.org/advisories/RUSTSEC-2026-0258
# Solution: Upgrade to >=0.4.16
#
# Crate:    h2
# Version:  0.4.13
# Title:    h2 unbounded empty DATA frames
# ...

Expected vs Actual

Expected: cargo audit reports 0 vulnerabilities
Actual: 2 vulnerabilities from RUSTSEC-2026-0258; Security Audit CI job fails on all PRs targeting main

Environment

• caro version: 1.5.0 (be07b22 2026-07-18)
• OS: Linux x86_64 (GitHub Actions ubuntu runner)
• Test date: 2026-09-08
• Backend: CLI not involved (dependency audit)

Investigation

• Advisory RUSTSEC-2026-0258 published 2026-08-17
• h2 appears as a transitive dependency (via reqwest → hyper → h2)
• Both h2 v0.3.27 (older reqwest path) and v0.4.13 (newer reqwest path) are affected
• Fix: cargo update -p h2 to pull >=0.4.16; verify reqwest and hyper-util chains resolve cleanly
• 12 additional warnings (unsound/yanked) are currently allow-listed and not blocking

Severity

P1 — advertised network feature relies on h2; DoS exposure in HTTP/2 layer. Security Audit CI blocks all PRs until resolved.

---

Prompt used to generate this comment

caro QA agent — security finding from daily rotation slot A+B+C, scheduled remote run 2026-09-08

[github-actions]

🔍 Bug Report Validation

Status: ⏳ Missing Information

Thank you for reporting this bug! To help us investigate effectively, we need a bit more information:

Required Information

• Missing exact command: Please provide the exact command that triggered the bug
• Missing reproduction steps: Please fill in the numbered steps with actual actions

Suggestions

• Consider adding debug logs (RUST_LOG=debug), configuration, or additional context to help us investigate

How to Update

1. Click "Edit" on your original issue description
2. Fill in the missing information
3. Click "Update comment"

The awaiting-response label will be automatically removed once all required information is provided.

Need Help?

If you're unsure about any of these fields:

• Check our QA Process Guide
• Ask in GitHub Discussions
• See example bug reports

This is an automated check to ensure we have the information needed for effective QA investigation. Thank you for helping improve caro! 🙏