Skip to content
OpenAdvisories

Package · Debian

h2o

19 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-44452

    h2o is vulnerable to heap overrun

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying t…

    h2o h2o dnsdist h2o Debian Ubuntu
  • Medium 5.9
    CVE-2024-45397

    H2O alllows bypassing address-based access control with 0-RTT

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and…

    h2o h2o h2o h2o Debian Ubuntu
  • Medium 6.1
    CVE-2023-41337

    h2o vulnerable to TLS session resumption misdirection

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious b…

    h2o h2o h2o h2o Debian Ubuntu