Description
Use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
References (3)
Core 3
Core References
Third Party Advisory, VDB Entry vdb-entry
x_refsource_bid
http://www.securityfocus.com/bid/95061
Patch, Third Party Advisory x_refsource_confirm
https://github.com/h2o/h2o/issues/1144
Third Party Advisory, VDB Entry third-party-advisory
x_refsource_jvn
https://jvn.jp/en/jp/JVN44566208/index.html
Scores
CVSS v3
9.1
EPSS
0.0218
EPSS Percentile
80.2%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Details
CWE
CWE-416
Status
published
Products (3)
dena/h2o
< 2.0.4
h2o_project/h2o
2.1.0 beta3
Kazuho Oku/H2O
version 2.0.4 and earlier
Published
Jun 09, 2017
Tracked Since
Feb 18, 2026