CVE-2023-30847

H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.

• CWE-824

• https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33Patch
• https://github.com/h2o/h2o/pull/3229Vendor Advisory
• https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvxPatch, Vendor Advisory
• https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33Patch
• https://github.com/h2o/h2o/pull/3229Vendor Advisory
• https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvxPatch, Vendor Advisory

Published

Apr 27, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-30841Baremetal Operator (BMO) is a bare metal host provisioning i…5.5
• CVE-2023-30842Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2023-30843Payload is a free and open source headless content managemen…6.5
• CVE-2023-30844Mutagen provides real-time file synchronization and flexible…8.8
• CVE-2023-30845ESPv2 is a service proxy that provides API management capabi…9.8
• CVE-2023-30846typed-rest-client is a library for Node Rest and Http Client…7.5
• CVE-2023-30848Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30849Pimcore is an open source data and experience management pla…8.8
• CVE-2023-3085A vulnerability, which was classified as problematic, has be…6.1
• CVE-2023-30850Pimcore is an open source data and experience management pla…8.8
• CVE-2023-30851Cilium is a networking, observability, and security solution…5.3
• CVE-2023-30852Pimcore is an open source data and experience management pla…4.9