CVE-2016-4817

Name: CVE-2016-4817
Creator: NVD / NIST
Published: 2016-06-19T01:59:11.903+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

UnknownEPSS 4.45%

Last modified Jun 17, 2026

CVE-2016-4817 is a vulnerability of currently unknown severity. lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.. EPSS estimates a 4.45% chance of exploitation in the next 30 days.

Description

lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.

Metrics

EPSS Probability

4.45%

90.2th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions	Update
Dena	H2o	<= 1.7.2	—
Dena	H2o	<= 2.0.0	Beta4

References

http://jvn.jp/en/jp/JVN87859762/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000091Vendor Advisory
https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4
https://github.com/h2o/h2o/pull/920Vendor Advisory
http://jvn.jp/en/jp/JVN87859762/index.htmlVendor Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2016-000091Vendor Advisory
https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4
https://github.com/h2o/h2o/pull/920Vendor Advisory

Timeline

Published: Jun 19, 2016
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-4817?

How severe is CVE-2016-4817?

Severity scoring for CVE-2016-4817 is pending analysis. The EPSS model estimates a 4.45% probability of exploitation in the next 30 days.

How do I fix CVE-2016-4817?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2016-4817?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST