CVE-2023-30847

HIGH EPSS 55.2%
Published Apr 27, 20233y ago · Modified Jun 17, 20262w ago
8.2 CVSS 3.1
High
Find Similar
Published Apr 27, 2023 3y ago
Last Modified Jun 17, 2026 2w ago

Description

H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.

CVSS Details

Base Score
8.2
Exploitability
3.9
Impact
4.2
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity None
Availability High

Threat Intelligence

EPSS Exploit Probability
55.2% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-824

Affected Products 3

VendorProductVersionRange
denah2o* ≤2.2.6
denah2o2.3.0any
denah2o2.3.0any

References 3

  • github.com https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33
    Patch
  • github.com https://github.com/h2o/h2o/pull/3229
    Vendor Advisory
  • github.com https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx
    PatchVendor Advisory

Remediation

  • github.com https://github.com/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33
    Patch
  • github.com https://github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx
    PatchVendor Advisory