Unscored CVE-2017-10868 EUVD-2017-2508GHSA-p9v4-5fvf-9qmw

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.

Published Dec 22, 2017 · Updated Aug 5, 2024 · Assigned by jpcert

Vendor: Kazuho Oku Product: H2O Package: h2o Ecosystem: Debian

Description

Affected products

Vendor	Product	Affected	Fixed
Kazuho Oku	H2O	version 2.2.2 and earlier	—

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗

Release	Package	Fixed in	Advisory
Debian 12	h2o	2.2.3+dfsg-1	—

References

https://github.com/h2o/h2o/issues/1459
JVN#84182676 third-party-advisory