Skip to content
OpenAdvisories

Vendor

h2o

22 known vulnerabilities.

Products

h2o 13 quicly 6 picotls 3
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Low 3.7
    CVE-2024-45403

    H2O assertion failure when HTTP/3 requests are cancelled

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a De…

    h2o h2o h2o Ubuntu
  • Low 3.1
    CVE-2024-25622

    H2O ignores headers configuration directives

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g…

    h2o h2o h2o h2o Debian Ubuntu
  • Low 3.7
    CVE-2023-50247

    h2o QUIC state exhaustion DoS

    h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can …

    h2o h2o