Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2024-45397

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.

Published

2024-10-11T15:15:04.690

Last Modified

2024-11-12T20:14:25.083

Status

Analyzed

Source

[email protected]

Severity

CVSSv3.1: 5.9 (MEDIUM)

Weaknesses
  • Type: Secondary
    CWE-284
  • Type: Primary
    CWE-290
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application dena h2o < 2024-10-10 Yes
References