What’s Vulnerable › Vulnerabilities

CVE-2024-45403: H2O assertion failure when HTTP/3 requests are cancelled

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.7% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-10-11 · updated 2026-06-17
• Weakness: CWE-617

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.

Affected products

• h2o: from 2024-06-18 before 2024-09-04 — fixed in 2024-09-04

How to fix

Upgrade to a fixed version: h2o 2024-09-04. Check the vendor advisory for mitigations.

References

• https://github.com/h2o/h2o/commit/16b13eee8ad7895b4fe3fcbcabee53bd52782562
• https://github.com/h2o/h2o/commit/1ed32b23f999acf0c5029f09c8525f93eb1d354c
• https://github.com/h2o/h2o/security/advisories/GHSA-4xp5-3jhc-3m92
• https://h2o.examp1e.net/configure/http3_directives.html

Get alerted when CVE-2024-45403 or the next vulnerability affects your stack