Read the docs
TI-2024-16850 Aliases CVE-2024-25622

H2O ignores headers configuration directives

Priority LOW 20CWE-670Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA.

Summary

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00463 40th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed h2o (h2o): 123f5e2b65dcdba8f7ef659a00d24bd1249141be

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
h2oaih2obefore 123f5e2b65dcdba8f7ef659a00d24bd1249141be123f5e2b65dcdba8f7ef659a00d24bd1249141bePatch availableCNA
  • h2o Vendorh2oai Affected before 123f5e2b65dcdba8f7ef659a00d24bd1249141be Fixed in 123f5e2b65dcdba8f7ef659a00d24bd1249141be Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*up to 2024-02-11VulnerableKazuho Oku
  • cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:* Versions up to 2024-02-11 Vulnerable ·Kazuho Oku

Remediation

  • Fix · CNA h2o (h2o) Fixed in 123f5e2b65dcdba8f7ef659a00d24bd1249141be

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-25622

References

Exploit 1

Patch 1

Other 1

  • TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
  • TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences