Skip to content
OpenAdvisories
Unscored CVE-2017-10908 EUVD-2017-2547GHSA-hcqf-mq24-hm46

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.

Published Dec 22, 2017 · Updated Aug 5, 2024 · Assigned by jpcert

Vendor: Kazuho Oku Product: H2O Package: h2o Ecosystem: Debian

Description

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.

Affected products

VendorProductAffectedFixed
Kazuho Oku H2O version 2.2.3 and earlier —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 12 h2o 2.2.4+dfsg-1 —

References