What’s Vulnerable › Products

h2o vulnerabilities

18 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 1 published in the last 12 months.

Check whether your h2o version is affected

Exploited h2o vulnerabilities

• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability

Latest h2o vulnerabilities

• CVE-2026-55213 — h2o: musl libc stack overflow (QPACK) (CVSS 7.5)
• CVE-2024-45403 — H2O assertion failure when HTTP/3 requests are cancelled (CVSS 7.5)
• CVE-2024-45397 — H2O alllows bypassing address-based access control with 0-RTT (CVSS 7.5)
• CVE-2024-25622 — H2O ignores headers configuration directives (CVSS 4.3)
• CVE-2023-50247 — h2o QUIC state exhaustion DoS (CVSS 7.5)
• CVE-2023-41337 — h2o vulnerable to TLS session resumption misdirection (CVSS 6.7)
• CVE-2023-44487 — HTTP/2 Rapid Reset Attack Vulnerability (CVSS 7.5) — exploited
• CVE-2023-30847 — H2O vulnerable to read from uninitialized pointer in the reverse proxy handler (CVSS 8.2)
• CVE-2021-43848 — Unititialized memory access in h2o (CVSS 5.9)
• CVE-2018-0608 — (CVSS 9.8)
• CVE-2017-10908 — (CVSS 7.5)
• CVE-2017-10872 — (CVSS 6.5)
• CVE-2017-10869 — (CVSS 7.5)
• CVE-2017-10868 — (CVSS 7.5)
• CVE-2016-7835 — (CVSS 9.1)
• CVE-2016-4864 — (CVSS 7.5)
• CVE-2016-4817 — (CVSS 7.5)
• CVE-2016-1133 — (CVSS 3.7)