CVE-2024-45403: H2O assertion failure when HTTP/3 requests are cancelled
First published: Fri Oct 11 2024(Updated: )
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Dena H20 | >=2024-06-18<2024-09-04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of CVE-2024-45403?
The severity of CVE-2024-45403 is categorized as a Denial-of-Service vulnerability.
How do I fix CVE-2024-45403?
To fix CVE-2024-45403, you should upgrade your h2o server to a patched version released after September 4, 2024.
What are the potential impacts of CVE-2024-45403?
CVE-2024-45403 can lead to service interruptions or crashes, impacting availability for users.
Who is affected by CVE-2024-45403?
Users running h2o versions between June 18, 2024, and September 4, 2024, are affected by CVE-2024-45403.
How does CVE-2024-45403 exploit the server?
CVE-2024-45403 exploits the server by triggering an assertion failure during the cancellation of HTTP/3 requests.
- agent/weakness
- agent/title
- agent/references
- agent/type
- agent/description
- agent/first-publish-date
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/remedy
- agent/last-modified-date
- agent/severity
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/dena
- canonical/dena h20
- version/dena h20/2024-06-18