H2O vulnerabilities

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.

Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allow remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.

In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.

A use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.

In the h2o HTTP server prior to commit 9265bdd, there is an HTTP/2 state amplification vulnerability that combines HPACK decompression amplification with Slowloris-style stream stalling. Decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack.

The h2o HTTP server prior to commit 6b5370d is vulnerable to a Denial of Service attack due to excessive stack memory allocation via alloca. When serving static files, the allocation size can reach ~600KB, exceeding the default pthread stack size in musl libc (128KB), causing a segmentation fault and server crash.

A vulnerability in the h2o HTTP server prior to commit 8dc37cb causes an out-of-bounds read when processing a ClientHello message over TLS or QUIC containing a zero-length SNI extension. This can lead to a segmentation violation and potential denial-of-service (DoS) attack.

A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.