Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.99999 · Published 2023-10-10 · Partial fix · 1.28.0, 0.17.0 +9 CWE-400
Priority MEDIUM 49
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case.
CVSS 3.1CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.00478 · Published 2024-10-11 · Fixed in 9b88159ce763d680e4a13b6e8f3171ae923a535d CWE-415
Priority MEDIUM 48
Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
CVSS 3.0CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.03726 · Published 2018-06-26 · No fix listed CWE-119
Priority MEDIUM 44
Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
CVSS 3.0CRITICAL 9.1· Network · No auth · No interaction · EPSS 0.02227 · Published 2017-06-09 · No fix listed CWE-416
Priority MEDIUM 43
H2O is an HTTP server.
CVSS 3.1HIGH 8.2· Network · No auth · No interaction · EPSS 0.00902 · Published 2023-04-27 · No fix listed CWE-824
Priority MEDIUM 40
Quicly is an IETF QUIC protocol implementation.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00585 · Published 2024-10-11 · Fixed in 2a95896104901589c495bc41460262e64ffcad5c CWE-617
Priority MEDIUM 40
lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.04448 · Published 2016-06-19 · No fix listed
Priority LOW 39
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03636 · Published 2017-12-22 · No fix listed CWE-20
Priority LOW 39
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.03534 · Published 2017-12-22 · No fix listed CWE-20
Priority LOW 38
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.02676 · Published 2017-12-22 · No fix listed CWE-119
Priority LOW 37
h2o is an open source http server.
CVSS 3.1HIGH 7.4· Network · No auth · No interaction · EPSS 0.02667 · Published 2022-02-01 · No fix listed CWE-908
Priority LOW 36
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.01802 · Published 2017-05-12 · No fix listed CWE-134
Priority LOW 34
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00653 · Published 2024-10-11 · Fixed in 1ed32b23f999acf0c5029f09c8525f93eb1d354c CWE-617
Priority LOW 34
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00857 · Published 2023-12-12 · No fix listed CWE-770
Priority LOW 33
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.00441 · Published 2024-10-11 · Fixed in 15ed15a2efb83a77bb4baaa5a119e639c2f6898a CWE-284
Priority LOW 33
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.
CVSS 3.0MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.01941 · Published 2017-12-22 · No fix listed CWE-118
Priority LOW 29
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
CVSS 3.1MEDIUM 6.7· Adjacent network · Low privileges · User interaction · EPSS 0.00181 · Published 2023-12-12 · No fix listed CWE-347
Priority LOW 23
Directory traversal vulnerability in H2O before 1.4.5 and 1.5.x before 1.5.0-beta2, when the file.dir directive is enabled, allows remote attackers to read arbitrary files via a crafted URL.
CVSS 2.0MEDIUM 4.3· Network · No auth · Interaction — · EPSS 0.01655 · Published 2015-09-20 · No fix listed CWE-22
Priority LOW 21
CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting…
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.01459 · Published 2016-01-16 · No fix listed
Priority LOW 20
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
CVSS 3.1MEDIUM 4.3· Network · Low privileges · No interaction · EPSS 0.00463 · Published 2024-10-11 · Fixed in 123f5e2b65dcdba8f7ef659a00d24bd1249141be CWE-670
Priority LOW 18
'Mobaoku-Auction&Flea Market' App for iOS versions prior to 5.5.16 improperly verifies server certificates, which may allow an attacker to eavesdrop on an encrypted communication via a man-in-the-middle attack.
CVSS 3.1LOW 3.7· Network · No auth · No interaction · EPSS 0.00377 · Published 2022-06-14 · Fixed in 5.5.16 CWE-295
THREATIST.IORead the docs