Hh2o

Products

Exploited and recent CVEs

• CVE-2026-55367 High 7.5 h2o: heap exhaustion using capsules 0.3%
• CVE-2026-55368 High 8.1 h2o: buffer overflow when using the %{error}x log directive 0.3%
• CVE-2026-59993 Medium 6.5 Picotls has NULL pointer dereference during handshake, when running as a client 0.2%
• CVE-2026-45271 Medium 5.5 picotls has infinite recursion in the minicrypto ASN.1 decoder 0.2%
• CVE-2026-54340 High 7.5 h2o has HTTP/2 state amplification 0.5%
• CVE-2026-44453 High 7.5 h2o is vulnerable to musl libc stack overflow 0.5%
• CVE-2026-44452 Medium 5.9 h2o is vulnerable to heap overrun 0.4%
• CVE-2026-44436 High 7.5 Quicly is vulnerable to connection state corruption 0.5%
• CVE-2026-44435 High 7.5 Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB 0.5%
• CVE-2026-44434 Medium 5.3 Quicly is vulnerable to stateless reset injection 0.2%
• CVE-2026-44433 Medium 5.3 Quicly is vulnerable to memory exhaustion 0.5%
• CVE-2026-55213 High 7.5 h2o: musl libc stack overflow (QPACK) 0.5%
• CVE-2025-61684 High 7.5 Quicly has assertion failures 0.4%
• CVE-2024-45402 High 8.6 Picotls double free 0.5%
• CVE-2024-45396 High 7.5 Quicly assertion failures 0.6%
• CVE-2024-45403 Low 3.7 H2O assertion failure when HTTP/3 requests are cancelled 0.7%
• CVE-2024-45397 Medium 5.9 H2O alllows bypassing address-based access control with 0-RTT 0.4%
• CVE-2024-25622 Low 3.1 H2O ignores headers configuration directives 0.5%
• CVE-2023-50247 Low 3.7 h2o QUIC state exhaustion DoS 0.9%
• CVE-2023-41337 Medium 6.1 h2o vulnerable to TLS session resumption misdirection 0.2%
• CVE-2023-30847 High 8.2 H2O vulnerable to read from uninitialized pointer in the reverse proxy handler 0.9%
• CVE-2021-43848 High 7.4 Unititialized memory access in h2o 2.7%