CVE-2016-4817
HighSummary
In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.
Risk Assessment
Remote attackers may exploit this vulnerability to disrupt application functionality or gain control over the system, posing a significant security threat to the organization.
Recommendation
It is recommended to update H2O to version 1.7.3 or 2.0.0-beta5 or later to mitigate this vulnerability.
Other vulnerabilities in H2O
See all- CVE-2017-10908High
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
- CVE-2017-10869High
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
- CVE-2017-10868High
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
- CVE-2016-4864High
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allow remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
- CVE-2016-7835Critical
A use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
- CVE-2026-54340High
In the h2o HTTP server prior to commit 9265bdd, there is an HTTP/2 state amplification vulnerability that combines HPACK decompression amplification with Slowloris-style stream stalling. Decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack.
- CVE-2026-44453High
The h2o HTTP server prior to commit 6b5370d is vulnerable to a Denial of Service attack due to excessive stack memory allocation via alloca. When serving static files, the allocation size can reach ~600KB, exceeding the default pthread stack size in musl libc (128KB), causing a segmentation fault and server crash.
- CVE-2026-44452Medium
A vulnerability in the h2o HTTP server prior to commit 8dc37cb causes an out-of-bounds read when processing a ClientHello message over TLS or QUIC containing a zero-length SNI extension. This can lead to a segmentation violation and potential denial-of-service (DoS) attack.
- CVE-2026-55213High
A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.
Original NVD description (English source)
lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.