Read the docs
TI-2024-30452 Aliases CVE-2024-45403

H2O assertion failure when HTTP/3 requests are cancelled

Priority LOW 34CWE-617Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-617.

Summary

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00653 51st percentileScored 2026-11-07
Fix Fixed h2o (h2o): 1ed32b23f999acf0c5029f09c8525f93eb1d354c

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
h2oaih2o16b13eee8ad7895b4fe3fcbcabee53bd52782562 to before 1ed32b23f999acf0c5029f09c8525f93eb1d354c1ed32b23f999acf0c5029f09c8525f93eb1d354cPatch availableCNA
  • h2o Vendorh2oai Affected 16b13eee8ad7895b4fe3fcbcabee53bd52782562 to before 1ed32b23f999acf0c5029f09c8525f93eb1d354c Fixed in 1ed32b23f999acf0c5029f09c8525f93eb1d354c Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*2024-06-18 to before 2024-09-04VulnerableKazuho Oku
  • cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:* Versions 2024-06-18 to before 2024-09-04 Vulnerable ·Kazuho Oku

Remediation

  • Fix · CNA h2o (h2o) Fixed in 1ed32b23f999acf0c5029f09c8525f93eb1d354c

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-45403
  2. 2026-10-14 EPSS moved to the 50th–90th percentile

References

Patch 2

Advisory 1

Other 1

  • TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
  • TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences