TI-2024-30451 Aliases CVE-2024-45402

Picotls double free

MEDIUM 49CWE-415Published 2024-10-11 · Updated 2024-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-415 and the CVSS impact.

Summary

Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurs during the disposal of multiple objects without any intervening calls to malloc Typically, this triggers the malloc implementation to detect the error and abort the process. However, depending on the internals of malloc and the crypto backend being used, the flaw could potentially lead to a use-after-free scenario, which might allow for arbitrary code execution. The vulnerability is addressed with commit 9b88159ce763d680e4a13b6e8f3171ae923a535d.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00478 41st percentileScored 2026-11-07

Fix Fixed picotls (h2o): 9b88159ce763d680e4a13b6e8f3171ae923a535d

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
h2oai	picotls	before 9b88159ce763d680e4a13b6e8f3171ae923a535d	9b88159ce763d680e4a13b6e8f3171ae923a535d	Patch available	CNA

picotls Vendorh2oai Affected before 9b88159ce763d680e4a13b6e8f3171ae923a535d Fixed in 9b88159ce763d680e4a13b6e8f3171ae923a535d Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:dena:picotls::::::::	2024-08-12 to before 2024-10-10	Vulnerable	Kazuho Oku

cpe:2.3:a:dena:picotls:*:*:*:*:*:*:*:* Versions 2024-08-12 to before 2024-10-10 Vulnerable ·Kazuho Oku

Remediation

Fix · CNA picotls (h2o) Fixed in 9b88159ce763d680e4a13b6e8f3171ae923a535d

Timeline

2026-10-02 Threatist record created from CVE-2024-45402

References

Patch 1

https://github.com/h2o/picotls/commit/9b88159ce763d680e4a13b6e8f3171ae923a535d

Advisory 1

https://github.com/h2o/picotls/security/advisories/GHSA-w7c8-wjx9-vvvv

TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences