CVE-2018-0608 Memory corruption in H2O

What is CVE-2018-0608?

CVE-2018-0608 is a critical memory corruption vulnerability in Kazuho Oku H2O, published on 26 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (DoS) via unspecified vectors.

Weakness: CWE-119

Which versions are affected by CVE-2018-0608?

It affects 1 product.

Products include Dena H2o.

How do I fix CVE-2018-0608?

Upgrade to a fixed version.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2018-0608 being exploited?

There is no known exploitation of CVE-2018-0608 in the wild and no public exploit code.

Other vulnerabilities in Kazuho Oku H2O

• CVE-2016-7835 Use after free in H2O Critical 9.1
• CVE-2023-30847 H2O vulnerable to read from uninitialized pointer in the reverse proxy handler High 8.2
• CVE-2017-10868 Denial of service in H2O High 7.5
• CVE-2017-10869 Memory corruption in H2O High 7.5
• CVE-2017-10908 Denial of service in H2O High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2018-0608, GHSA-crhj-h9hx-58vj, UBUNTU-CVE-2018-0608.