Need to update hyper to avoid RUSTSEC-2026-0258 in h2

Rocket Version

0.5.1

Operating System

Linux

Rust Toolchain Version

1.98.0-beta.6 (0c45ca314 2026-07-25)

What happened?

Rocket depends on hyper 0.14 which depends on h2 0.3. h2 0.3 has not been updated to fix RUSTSEC-2026-0258, a denial-of-service vulnerability.

This would be a vulnerability in Rocket in configurations where Rocket is directly exposed to possibly-hostile clients.

Test Case

Add Rocket to your project and run cargo audit.

Log Output

Crate:     h2
Version:   0.3.27
Title:     h2 unbounded empty DATA frames
Date:      2026-08-17
ID:        RUSTSEC-2026-0258
URL:       https://rustsec.org/advisories/RUSTSEC-2026-0258
Solution:  Upgrade to >=0.4.16
Dependency tree:
h2 0.3.27
└── hyper 0.14.32
    └── rocket_http 0.5.1
        ├── rocket_codegen 0.5.1
        │   └── rocket 0.5.1
        │       └── tag2upload-service-manager 0.2.0
        └── rocket 0.5.1

Additional Context

(I'm ticking all four boxes as gitlab insists even though this is a build system issue with the latest release of Rocket, not a code problem in git.)

System Checks

• My bug report relates to functionality.
• I have tested against the latest Rocket release or a recent git commit.
• I have tested against the latest stable rustc toolchain.
• I was unable to find this issue previously reported.