CVE-2024-45403

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.

• CWE-617

• https://github.com/h2o/h2o/commit/16b13eee8ad7895b4fe3fcbcabee53bd52782562Patch
• https://github.com/h2o/h2o/commit/1ed32b23f999acf0c5029f09c8525f93eb1d354cPatch
• https://github.com/h2o/h2o/security/advisories/GHSA-4xp5-3jhc-3m92Vendor Advisory
• https://h2o.examp1e.net/configure/http3_directives.htmlProduct

Published

Oct 11, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-45398Contao is an Open Source CMS. In affected versions a back en…8.8
• CVE-2024-45399Indico is an event management system that uses Flask-Multipa…6.1
• CVE-2024-4540A flaw was found in Keycloak in OAuth 2.0 Pushed Authorizati…7.5
• CVE-2024-45400ckeditor-plugin-openlink is a plugin for the CKEditor JavaSc…6.1
• CVE-2024-45401stripe-cli is a command-line tool for the payment processor …7.1
• CVE-2024-45402Picotls is a TLS protocol library that allows users select d…9.8
• CVE-2024-45404OpenCTI is an open-source cyber threat intelligence platform…8.1
• CVE-2024-45405`gix-path` is a crate of the `gitoxide` project (an implemen…6
• CVE-2024-45406Craft is a content management system (CMS). Craft CMS 5 stor…4.8
• CVE-2024-45407Sunshine is a self-hosted game stream host for Moonlight. Cl…5.3
• CVE-2024-45408eLabFTW is an open source electronic lab notebook for resear…6.5
• CVE-2024-45409The Ruby SAML library is for implementing the client side of…9.8