Vulnerabilities in h2o
22 resultsCVE-2021-43848HIGHUnititialized memory access in h2oEPSS 2.7%CVE-2023-30847HIGHH2O vulnerable to read from uninitialized pointer in the reverse proxy handlerEPSS 0.9%CVE-2023-50247LOWh2o QUIC state exhaustion DoSEPSS 0.9%CVE-2024-45403LOWH2O assertion failure when HTTP/3 requests are cancelledEPSS 0.7%CVE-2024-45396HIGHQuicly assertion failuresEPSS 0.6%CVE-2026-44436HIGHQuicly is vulnerable to connection state corruptionEPSS 0.5%CVE-2026-54340HIGHh2o has HTTP/2 state amplificationEPSS 0.5%CVE-2026-55213HIGHh2o: musl libc stack overflow (QPACK)EPSS 0.5%CVE-2026-44453HIGHh2o is vulnerable to musl libc stack overflowEPSS 0.5%CVE-2026-44435HIGHQuicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KBEPSS 0.5%CVE-2026-44433MEDIUMQuicly is vulnerable to memory exhaustionEPSS 0.5%CVE-2024-45402HIGHPicotls double freeEPSS 0.5%CVE-2024-25622LOWH2O ignores headers configuration directivesEPSS 0.5%CVE-2024-45397MEDIUMH2O alllows bypassing address-based access control with 0-RTTEPSS 0.4%CVE-2026-44452MEDIUMh2o is vulnerable to heap overrunEPSS 0.4%CVE-2025-61684HIGHQuicly has assertion failuresEPSS 0.4%CVE-2026-55367HIGHh2o: heap exhaustion using capsulesEPSS 0.3%CVE-2026-55368HIGHh2o: buffer overflow when using the %{error}x log directiveEPSS 0.3%CVE-2026-59993MEDIUMPicotls has NULL pointer dereference during handshake, when running as a clientEPSS 0.2%CVE-2026-44434MEDIUMQuicly is vulnerable to stateless reset injectionEPSS 0.2%