Product:

H2o

(Dena)
Repositories https://github.com/h2o/h2o
#Vulnerabilities 17
Date Id Summary Products Score Patch Annotated
2022-02-01 CVE-2021-43848 h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP... H2o 5.9
2017-12-22 CVE-2017-10868 H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header. H2o 7.5
2018-06-26 CVE-2018-0608 Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors. H2o 9.8
2017-12-22 CVE-2017-10908 H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header. H2o 7.5
2017-12-22 CVE-2017-10872 H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via unspecified vectors. H2o 6.5
2017-12-22 CVE-2017-10869 Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors. H2o 7.5
2017-06-09 CVE-2016-7835 Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information. H2o, H2o 9.1
2016-06-19 CVE-2016-4817 lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet. H2o 7.5
2016-01-16 CVE-2016-1133 CRLF injection vulnerability in the on_req function in lib/handler/redirect.c in H2O before 1.6.2 and 1.7.x before 1.7.0-beta3 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via a crafted URI. H2o 3.7
2017-05-12 CVE-2016-4864 H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy. H2o 7.5