CVE-2024-45403 Details
Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.
An assertion failure vulnerability has been identified in the h2o HTTP server when it is configured as a reverse proxy and handling HTTP/3 requests. If a client cancels an HTTP/3 request, h2o may crash due to the assertion failure. This crash can be exploited to disrupt service, causing a denial-of-service condition. Although the h2o standalone server typically restarts automatically, minimizing the disruption, concurrent HTTP requests that were being served will still be interrupted. The vulnerability affects h2o versions between commits 16b13ee and 15ed15a.
Users can upgrade to h2o commit 1ed32b2 or later to address this vulnerability. Alternatively, HTTP/3 can be disabled by removing or commenting out the listen directives that use the quic type or attribute.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Oct 11, 2024References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-617 | Reachable Assertion | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| dena h2o | >= 2024-06-18, < 2024-09-04 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Nov 12, 2024 | Initial Analysis | [email protected] |
| Oct 11, 2024 | New CVE Received | [email protected] |