p PatchFirst

CVE-2024-45403

CVE-2024-45403 · H2O assertion failure when HTTP/3 requests are cancelled

This page contains facts from public vulnerability sources. Check the original advisory before updating.

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.

CVSS 3.7 · Low · EPSS 0.7%

Published
Updated

Stack: system

Affected products and versions

  • h2o

    Versions
    • >= 16b13eee8ad7895b4fe3fcbcabee53bd52782562, < 1ed32b23f999acf0c5029f09c8525f93eb1d354c: Affected

    No fix published

  • h2o Ubuntu:Pro:18.04:LTS

    Versions
    • 2.2.3+dfsg-2
    • 2.2.4+dfsg-1
    • 2.2.4+dfsg-1build1
    • 2.2.4+dfsg-1ubuntu0.1~esm2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • h2o Ubuntu:Pro:20.04:LTS

    Versions
    • 2.2.5+dfsg2-3
    • 2.2.5+dfsg2-3build1
    • 2.2.5+dfsg2-3ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • h2o Ubuntu:Pro:22.04:LTS

    Versions
    • 2.2.5+dfsg2-6
    • 2.2.5+dfsg2-6.1
    • 2.2.5+dfsg2-6.1ubuntu1
    • 2.2.5+dfsg2-6.1ubuntu2
    • 2.2.5+dfsg2-6.1ubuntu2+esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • h2o Ubuntu:24.04:LTS

    Versions
    • 2.2.5+dfsg2-7
    • 2.2.5+dfsg2-8
    • 2.2.5+dfsg2-8.1ubuntu1
    • 2.2.5+dfsg2-8.1ubuntu2
    • 2.2.5+dfsg2-8.1ubuntu3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →