CVE-2024-45403 H2O assertion failure when HTTP/3 requests are cancelled

What is CVE-2024-45403?

CVE-2024-45403 is a low-severity denial of service vulnerability in h2o, published on 11 Oct 2024. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.

Weakness: CWE-617

Which versions are affected by CVE-2024-45403?

It affects 1 product.

Products include Dena H2o.

How do I fix CVE-2024-45403?

No fix has been published for CVE-2024-45403 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2024-45403 being exploited?

There is no known exploitation of CVE-2024-45403 in the wild and no public exploit code.

Other vulnerabilities in h2o

• CVE-2018-0608 Memory corruption in H2O Critical 9.8
• CVE-2016-7835 Use after free in H2O Critical 9.1
• CVE-2023-30847 H2O vulnerable to read from uninitialized pointer in the reverse proxy handler High 8.2
• CVE-2017-10868 Denial of service in H2O High 7.5
• CVE-2017-10869 Memory corruption in H2O High 7.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-4xp5-3jhc-3m92, UBUNTU-CVE-2024-45403.