Priority LOW 39
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
Vulnerabilities
53 records
TI-2026-85218 CVE-2026-55368
Buffer overflow in h2o access-log formatter
Priority LOW 35
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
Priority LOW 28
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case.
Priority LOW 24
Picotls is a TLS protocol library that allows users select different crypto backends based on their use case.
TI-2026-46834 CVE-2026-65700 · GHSA-ffpm-9hgc-84cg
h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API
Priority HIGH 81
h2oGPT through 0.2.1 contains a path traversal vulnerability in the OpenAI-compatible files API that allows unauthenticated remote attackers to read, write, and delete arbitrary files accessible to the server process by…
TI-2026-39234 CVE-2026-54340
h2o has HTTP/2 state amplification
Priority LOW 39
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
TI-2026-32393 CVE-2026-44453
h2o is vulnerable to musl libc stack overflow
Priority LOW 39
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
TI-2026-32392 CVE-2026-44452
h2o is vulnerable to heap overrun
Priority LOW 27
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
Priority LOW 39
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server.
TI-2026-32376 CVE-2026-44435
Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
Priority LOW 39
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server.
Priority LOW 29
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server.
TI-2026-32374 CVE-2026-44433
Quicly is vulnerable to memory exhaustion
Priority LOW 39
Quicly is an IETF QUIC protocol implementation intended primarily for use within the H2O HTTP server.
TI-2026-39893 CVE-2026-55213
h2o: musl libc stack overflow (QPACK)
Priority LOW 39
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3.
TI-2026-07691 CVE-2026-8752 · GHSA-cq43-78ch-3f5q
h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control
Priority HIGH 70
A weakness has been identified in h2oai h2o-3 up to 7402.
TI-2026-07690 CVE-2026-8751 · GHSA-gvx7-3472-56wj
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
Priority LOW 37
A security flaw has been discovered in h2oai h2o-3 up to 7402.
TI-2026-07689 CVE-2026-8750 · GHSA-2g37-rjvj-534q
h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure
Priority HIGH 70
A vulnerability was identified in h2oai h2o-3 up to 7402.
TI-2026-03424 CVE-2026-3960 · GHSA-qmcv-hh7c-3m56
Remote Code Execution in h2oai/h2o-3
Priority HIGH 75
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior.
TI-2024-05547 CVE-2024-5986 · GHSA-wj3h-wx8g-x699
Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3
Priority MEDIUM 48
A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server.
TI-2025-38115 CVE-2025-61684
Quicly has assertion failures
Priority LOW 39
Quicly, an IETF QUIC protocol implementation, is susceptible to a denial-of-service attack prior to commit d9d3df6a8530a102b57d840e39b0311ce5c9e14e.
TI-2025-09860 CVE-2025-10769 · GHSA-9w9w-c98p-vmpv
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
Priority MEDIUM 57
A vulnerability has been found in h2oai h2o-3 up to 3.46.08.
TI-2025-09859 CVE-2025-10768 · GHSA-3qm2-4r9g-fg69
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
Priority MEDIUM 57
A flaw has been found in h2oai h2o-3 up to 3.46.08.
TI-2025-05944 CVE-2025-6544 · GHSA-5w3j-gwgh-4rfv
Deserialization Vulnerability in h2oai/h2o-3
Priority HIGH 82
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code.
Priority HIGH 82
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7.
Priority HIGH 75
A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files.
TI-2024-09772 CVE-2024-10549 · GHSA-wwr9-4gmr-xvq9
Denial of Service by ReDOS in h2oai/h2o-3
Priority HIGH 72
A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack.