High 1 exploited CVE USN-7892-1 1 CVE

h2o vulnerability

Published Nov 26, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that H2O exhibited poor server resource management in its
HTTP/2 protocol. An attacker could possibly use this issue to cause H2O to
crash, resulting in a denial of service.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · Pro 20.04 LTS Pro:20.04:LTS	h2o	2.2.5+dfsg2-3ubuntu0.1~esm1
Ubuntu · Pro 22.04 LTS Pro:22.04:LTS	h2o	2.2.5+dfsg2-6.1ubuntu2+esm1

Vulnerabilities 1

High 7.5

CVE-2023-44487 Exploited Public exploit EPSS 100%

HTTP/2 Stream Cancellation Attack

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL

Oct 10, 2023
KEV Oct 10, 2023

References

report
https://ubuntu.com/security/CVE-2023-44487