CVE-2024-45403
NoneCVSS
—
EPSS
0.7%
Published
Oct 11, 2024
CISA due date
—
Cloudanix analysis
A flaw in the h2o web server can let attackers knock it offline by sending and then cancelling certain web requests, briefly disrupting service until it restarts.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Moderate
- Impact
- Denial Of Service
- Component
- Network Service
- Class
- Denial of service
- Remediation
- Patch
- Effort
- Medium
- Patch risk
- Low
What it actually does
Assertion failure in h2o reverse proxy handling of cancelled HTTP/3 client requests leads to process crash.
Why it matters to the business
Service availability is interrupted for concurrent requests during crashes, requiring restarts even though the standalone server recovers automatically.
How an attack unfolds
An attacker sends HTTP/3 requests to a reverse proxy instance and abruptly cancels them, triggering the assertion failure and crash without authentication.
How to fix it
Upgrade to commit 16b13eee8ad7895b4fe3fcbcabee53bd52782562 or later; alternatively disable HTTP/3 support until patched.
How to confirm the fix worked
Confirm running version includes commit 16b13eee8ad7895b4fe3fcbcabee53bd52782562 and test HTTP/3 cancellation behavior does not crash the process.
Typical attack path
- Identify h2o instance configured as reverse proxy with HTTP/3 enabled
- Establish HTTP/3 connections and issue requests
- Cancel requests before completion to trigger assertion
- Repeat to sustain denial of service
How to detect it
Review h2o process and access logs for repeated unexpected terminations or restarts coinciding with HTTP/3 traffic patterns.
What your security team should do
- Apply the referenced commit immediately on all h2o instances using HTTP/3
- Disable HTTP/3 in reverse proxy configurations if upgrade cannot be performed promptly
- Monitor for unexpected process restarts in h2o logs
The record
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the h2o standalone server automatically restarts, minimizing the impact. However, HTTP requests that were served concurrently will still be disrupted. The vulnerability has been addressed in commit 1ed32b2. Users may disable the use of HTTP/3 to mitigate the issue.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Debian:11 | h2o | 0 | No fix |
| Debian:12 | h2o | 0 | No fix |
| Ubuntu:20.04:LTS | h2o | 0 | No fix |
| Ubuntu:22.04:LTS | h2o | 0 | No fix |
| Ubuntu:24.04:LTS | h2o | 0 | No fix |
| Ubuntu:24.10 | h2o | 0 | No fix |
| Ubuntu:25.04 | h2o | 0 | No fix |
| Ubuntu:25.10 | h2o | 0 | No fix |
| Ubuntu:Pro:18.04:LTS | h2o | 0 | No fix |
| Ubuntu:Pro:20.04:LTS | h2o | 0 | No fix |
| Ubuntu:Pro:22.04:LTS | h2o | 0 | No fix |