Read the docs
TI-2024-30446 Aliases CVE-2024-45397

H2O alllows bypassing address-based access control with 0-RTT

Priority LOW 33CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-284.

Summary

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00441 38th percentileScored 2026-11-07
Fix Fixed h2o (h2o): 15ed15a2efb83a77bb4baaa5a119e639c2f6898a

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
h2oaih2obefore 15ed15a2efb83a77bb4baaa5a119e639c2f6898a15ed15a2efb83a77bb4baaa5a119e639c2f6898aPatch availableCNA
  • h2o Vendorh2oai Affected before 15ed15a2efb83a77bb4baaa5a119e639c2f6898a Fixed in 15ed15a2efb83a77bb4baaa5a119e639c2f6898a Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*before 2024-10-10VulnerableKazuho Oku
  • cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:* Versions before 2024-10-10 Vulnerable ·Kazuho Oku

Remediation

  • Fix · CNA h2o (h2o) Fixed in 15ed15a2efb83a77bb4baaa5a119e639c2f6898a

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45397

References

Patch 1

Advisory 1

Other 1

  • TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
  • TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences