Advisories · Technology
h2o.
Every CVE that names h2o among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
h2o: heap exhaustion using capsules
- h2o
- Denial of service
- CVSS 8.1 High
h2o: buffer overflow when using the %{error}x log directive
- h2o
- Memory corruption
- CVSS 7.5 High
h2o has HTTP/2 state amplification
- h2o
- Denial of service
- CVSS 7.5 High
h2o is vulnerable to musl libc stack overflow
- h2o
- Denial of service
- CVSS 5.9 Medium
h2o is vulnerable to heap overrun
- h2o
- Memory corruption
- CWE-170
- CVSS 7.5 High
h2o: musl libc stack overflow (QPACK)
- h2o
- Denial of service
- CVSS 3.7 Low
H2O assertion failure when HTTP/3 requests are cancelled
- h2o
- Denial of service
- CVSS 5.9 Medium
H2O alllows bypassing address-based access control with 0-RTT
- h2o
- Broken access control
- CVSS 3.1 Low
H2O ignores headers configuration directives
- h2o
- CWE-670
- CVSS 3.7 Low
h2o QUIC state exhaustion DoS
- h2o
- Denial of service
- CVSS 6.1 Medium
h2o vulnerable to TLS session resumption misdirection
- h2o
- Weak cryptography or TLS
- CVSS 8.2 High
H2O vulnerable to read from uninitialized pointer in the reverse proxy handler
- h2o
- Memory corruption
- CVSS 7.4 High
Unititialized memory access in h2o
- h2o
- Memory corruption