Read the docs
TI-2023-27475 Aliases CVE-2023-50247

h2o QUIC state exhaustion DoS

Priority LOW 34CWE-770Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-770.

Summary

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressively increase the memory retained by the QUIC stack. This can eventually cause H2O to abort due to memory exhaustion. The vulnerability has been resolved in commit d67e81d03be12a9d53dc8271af6530f40164cd35. HTTP/1 and HTTP/2 are not affected by this vulnerability as they do not use QUIC. Administrators looking to mitigate this issue without upgrading can disable HTTP/3 support.

Why it matters now

EPSS 0.00857 58th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
h2oaih2oup to 2.3.0-beta2—No fix listedCNA
  • h2o Vendorh2oai Affected up to 2.3.0-beta2 Fixed in — No fix listed CNA

CPE configurations NVD · 3

CPEVersionsRoleVendor
cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*up to 2.2.6VulnerableKazuho Oku
cpe:2.3:a:dena:h2o:2.3.0:beta1:*:*:*:*:*:*2.3.0 beta1VulnerableKazuho Oku
cpe:2.3:a:dena:h2o:2.3.0:beta2:*:*:*:*:*:*2.3.0 beta2VulnerableKazuho Oku
  • cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:* Versions up to 2.2.6 Vulnerable ·Kazuho Oku
  • cpe:2.3:a:dena:h2o:2.3.0:beta1:*:*:*:*:*:* Versions 2.3.0 beta1 Vulnerable ·Kazuho Oku
  • cpe:2.3:a:dena:h2o:2.3.0:beta2:*:*:*:*:*:* Versions 2.3.0 beta2 Vulnerable ·Kazuho Oku

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-50247

References

Patch 2

  • TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
  • TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences