CVE-2023-44487

CVE-2023-44487 – HTTP/2 Rapid Reset DoS Root cause: HTTP/2 stream resets can cause servers to continue processing, leading to unbounded resource consumption and potential DoS when clients rapidly cancel streams. What’s affected: Various HTTP/2 implementations and deployments, including servers, p...

CVE-2017-10868

CVE-2017-10868 affects H2O Web Server (2.2.2 and earlier). DoS can be triggered remotely by a specially crafted HTTP/1 header, impacting availability. Affected product: H2O; root cause: flaw in HTTP/1 header processing. Remediation: update to the latest version (e.g., 2.2.3 or later) as advised b...

CVE-2023-41337

Summary: CVE-2023-41337 affects the H2O HTTP server prior to 2.3.0-beta2 when configured to listen on multiple addresses/ports with backend servers from multiple entities. A malicious backend that can observe/inject client–server packets may misdirect TLS session resumption, causing HTTPS request...

CVE-2018-0608

CVE-2018-0608 affects the H2O Web Server (versions 2.2.4 and earlier). The vulnerability is described as a heap/buffer overflow occurring when emitting or writing the access log, allowing a remote attacker to execute arbitrary code or cause a denial-of-service. Multiple sources (NVD, JVN, NASL/Ne...

CVE-2016-7835

The CVE-2016-7835 issue affects the H2O HTTP Server prior to version 2.0.5 and some 2.1.x builds (beta 4). Root cause is a use-after-free during the HTTP/1 to HTTP/2 upgrade, allowing remote attackers to cause a DoS and potentially access server certificate private keys or other information. Reme...

CVE-2024-45403

CVE-2024-45403 affects the H2O HTTP server when configured as a reverse proxy. The issue is an assertion failure caused by cancelled HTTP/3 requests, enabling a denial-of-service attack. By default, the standalone H2O server restarts automatically, which mitigates impact, but concurrent requests ...

CVE-2021-43848

CVE-2021-43848 concerns h2o, an open source HTTP server. Affects HTTP/3 support where, from commits 93af138 to d1f0f65, h2o may access uninitialized memory when processing QUIC frames, potentially treating such memory as HTTP/3 frames. In reverse proxy scenarios, an attacker could cause h2o to le...

CVE-2017-10869

H2O HTTP Server vulnerability CVE-2017-10869 is a stack-based buffer overflow affecting H2O versions 2.2.2 and earlier. The flaw allows remote unauthenticated attackers to cause a denial-of-service via unspecified vectors. Connected sources specify multiple DoS-related CVEs in H2O and indicate th...

CVE-2024-25622

Technical details about CVE-2024-25622 are not publicly provided in the connected documents. The available sources reiterate the issue and the fix commit; monitor for updates from vendor advisories for affected products, versions, and remediation steps.

CVE-2017-10908

CVE-2017-10908 affects the H2O HTTP Server (versions

CVE-2024-45397

Technical details (affected versions, fixes, and exploit info) are not provided in the supplied documents. Monitor for updates from vendors and security advisories.

CVE-2023-30847

CVE-2023-30847 affects the H2O HTTP server. In versions up to 2.3.0-beta2, the reverse proxy handler could read from an uninitialized pointer when processing a certain invalid HTTP request, potentially causing crashes or information leakage to backend servers. The issue was fixed by PR 3229 and m...

CVE-2017-10872

The CVE-2017-10872 entry concerns the H2O HTTP Server. Affected: H2O versions 2.2.3 and earlier. Issue: remote attackers can cause a denial of service in the server via unspecified vectors. Root cause details are not provided in the sources. Impact is described as denial of service (availability ...

CVE-2016-1133

CVE-2016-1133 affects the H2O HTTP Server. The vulnerability is a CRLF injection in the on_req function (lib/handler/redirect.c) that enables remote attackers to inject arbitrary HTTP headers and perform HTTP response splitting via a crafted URI. Affected versions are H2O before 1.6.2 and 1.7.x b...

CVE-2023-50247

The CVE-2023-50247 issue affects the h2o HTTP server (HTTP/1.x, HTTP/2, HTTP/3) where the QUIC stack (quicly), used in versions up to 2.3.0-beta, can trigger a state-exhaustion DoS when serving HTTP/3. The underlying cause is memory growth in the QUIC stack, which may lead to memory exhaustion an...

CVE-2016-4817

H2O vulnerability CVE-2016-4817 affects lib/http2/connection.c: disconnection handling causes a use-after-free in HTTP/2 processing. A crafted packet can lead to denial of service (application crash) and possibly arbitrary code execution. Affected versions are H2O before 1.7.3 and 2.x before 2.0....

CVE-2016-4864

CVE-2016-4864 affects H2O web server: versions 2.0.3 and earlier and 2.1.0-beta2 and earlier are vulnerable to a DoS via format string specifiers in template files processed by fastcgi, mruby, proxy, redirect or reproxy. Connected sources confirm this vulnerability class and affected ranges, with...