Priority LOW 34
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
Vulnerabilities
17 records
Priority LOW 33
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
TI-2024-16850 CVE-2024-25622
H2O ignores headers configuration directives
Priority LOW 20
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
TI-2023-27475 CVE-2023-50247
h2o QUIC state exhaustion DoS
Priority LOW 34
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
Priority LOW 29
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
TI-2023-23979 CVE-2023-44487 · GHSA-qppj-fm5r-hxr3
The HTTP/2 protocol allows a denial of service (server resource consumption) because…
Priority CRITICAL 90KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
TI-2023-14626 CVE-2023-30847
H2O vulnerable to read from uninitialized pointer in the reverse proxy handler
Priority MEDIUM 43
H2O is an HTTP server.
TI-2021-19654 CVE-2021-43848
Unititialized memory access in h2o
Priority LOW 37
h2o is an open source http server.
TI-2018-00565 CVE-2018-0608 · GHSA-crhj-h9hx-58vj
Memory corruption in Kazuho Oku H2O
Priority MEDIUM 48
Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.
TI-2017-07997 CVE-2017-10908 · GHSA-hcqf-mq24-hm46
Improper input validation in Kazuho Oku H2O
Priority LOW 39
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
TI-2017-07970 CVE-2017-10872 · GHSA-gq8c-8c44-g5xc
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the…
Priority LOW 33
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors.
TI-2017-07967 CVE-2017-10869 · GHSA-874p-r2p7-p9cg
Memory corruption in Kazuho Oku H2O
Priority LOW 38
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
TI-2017-07966 CVE-2017-10868 · GHSA-p9v4-5fvf-9qmw
Improper input validation in Kazuho Oku H2O
Priority LOW 39
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
TI-2016-06584 CVE-2016-7835 · GHSA-p8m4-qhm5-5gm6
Use after free in Kazuho Oku H2O
Priority MEDIUM 44
Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
TI-2016-04207 CVE-2016-4864 · GHSA-h4xp-827w-ffh7
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to…
Priority LOW 36
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
TI-2016-04162 CVE-2016-4817 · GHSA-32wr-c4w3-hg28
lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2…
Priority MEDIUM 40
lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute…
TI-2016-01039 CVE-2016-1133 · GHSA-mpq7-xv6q-mqgh
CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O…
Priority LOW 21
CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting…