H2o vulnerabilities

Products

• H2o 47
• Quicly 6
• Picotls 3

Newest

• h2o h2o: heap exhaustion using capsules CVE-2026-55367 7.5 HighNovember 4, 2026
• h2o h2o: buffer overflow when using the %{error}x log directive CVE-2026-55368 8.1 HighNovember 4, 2026
• h2o picotls Picotls has NULL pointer dereference during handshake, when running as a client CVE-2026-59993 6.5 MediumOctober 30, 2026
• h2o picotls picotls has infinite recursion in the minicrypto ASN.1 decoder CVE-2026-45271 5.5 MediumAugust 21, 2026
• h2o h2o has HTTP/2 state amplification CVE-2026-54340 7.5 HighJuly 16, 2026
• h2o h2o is vulnerable to musl libc stack overflow CVE-2026-44453 7.5 HighJuly 16, 2026
• h2o h2o is vulnerable to heap overrun CVE-2026-44452 5.9 MediumJuly 16, 2026
• h2o quicly Quicly is vulnerable to connection state corruption CVE-2026-44436 7.5 HighJuly 16, 2026
• h2o quicly Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB CVE-2026-44435 7.5 HighJuly 16, 2026
• h2o quicly Quicly is vulnerable to stateless reset injection CVE-2026-44434 5.3 MediumJuly 16, 2026
• h2o quicly Quicly is vulnerable to memory exhaustion CVE-2026-44433 5.3 MediumJuly 16, 2026
• h2o h2o: musl libc stack overflow (QPACK) CVE-2026-55213 7.5 HighJuly 10, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control CVE-2026-8752 6.9 MediumMay 17, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 JAR Model.java importBinaryModel deserialization CVE-2026-8751 6.9 MediumMay 17, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure CVE-2026-8750 6.9 MediumMay 17, 2026
• h2o, h2oai h2oai/h2o-3 +1 more Remote Code Execution in h2oai/h2o-3 CVE-2026-3960 Fix available 5.9 MediumApril 23, 2026
• h2o quicly Quicly has assertion failures CVE-2025-61684 7.5 HighJanuary 19, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization CVE-2025-10769 5.3 MediumSeptember 21, 2025
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization CVE-2025-10768 5.3 MediumSeptember 21, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Deserialization Vulnerability in h2oai/h2o-3 CVE-2025-6544 9.8 CriticalSeptember 21, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service by ReDOS in h2oai/h2o-3 CVE-2024-10549 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service in h2oai/h2o-3 CVE-2024-8062 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service in h2oai/h2o-3 CVE-2024-7768 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 CVE-2024-6863 6.5 MediumMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Arbitrary File Overwrite in h2oai/h2o-3 CVE-2024-8616 8.2 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service by ReDOS in h2oai/h2o-3 CVE-2024-10550 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Arbitrary File Overwrite in h2oai/h2o-3 CVE-2024-6854 7.1 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service and Arbitrary File Write in h2oai/h2o-3 CVE-2024-10572 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Jdbc Deserialization in h2oai/h2o-3 CVE-2024-10553 Fix available 9.8 CriticalMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service in h2oai/h2o-3 CVE-2024-7765 7.5 HighMarch 20, 2025
• dena picotls Picotls double free CVE-2024-45402 8.6 HighOctober 11, 2024
• dena quicly Quicly assertion failures CVE-2024-45396 7.5 HighOctober 11, 2024
• dena h2o H2O assertion failure when HTTP/3 requests are cancelled CVE-2024-45403 3.7 LowOctober 11, 2024
• dena h2o H2O alllows bypassing address-based access control with 0-RTT CVE-2024-45397 5.9 MediumOctober 11, 2024
• dena h2o H2O ignores headers configuration directives CVE-2024-25622 3.1 LowOctober 11, 2024
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization CVE-2024-8862 Fix available 6.9 MediumSeptember 14, 2024
• h2o, h2oai h2o-3 +1 more H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL CVE-2024-45758 9.1 CriticalSeptember 6, 2024
• h2o, h2oai h2oai/h2o-3, h2oai\/h2o-3 +2 more Denial of Service via Invalid Argument in h2oai/h2o-3 CVE-2024-5979 7.5 HighJune 27, 2024
• h2o, h2oai h2oai/h2o-3, h2oai\/h2o-3 +2 more Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3 CVE-2024-5550 5.3 MediumJune 6, 2024
• h2o, h2oai h2o-3, h2oai/h2o-3 +2 more S3 Bucket Takeover in h2oai/h2o-3 CVE-2024-1456 7.1 HighApril 16, 2024
• h2o, h2oai h2oai/h2o-3 +1 more External Control of File Name or Path in h2oai/h2o-3 CVE-2023-6569 Fix available 9.3 CriticalDecember 14, 2023
• dena h2o h2o QUIC state exhaustion DoS CVE-2023-50247 3.7 LowDecember 12, 2023
• dena h2o h2o vulnerable to TLS session resumption misdirection CVE-2023-41337 6.1 MediumDecember 12, 2023
• h2o, h2oai h2oai/h2o-3 +1 more H2O Local File Include CVE-2023-6013 9.3 CriticalNovember 16, 2023
• h2o, h2oai h2oai/h2o-3 +1 more H2O S3 Bucket Takeover CVE-2023-6017 8.7 HighNovember 16, 2023
• h2o, h2oai h2oai/h2o-3 +1 more Local File Inclusion in h2oai/h2o-3 CVE-2023-6038 9.3 CriticalNovember 16, 2023
• h2o, h2oai h2oai/h2o-3 +1 more H2O Remote Code Execution via POJO Model Import CVE-2023-6016 EPSS 30.6% 10.0 CriticalNovember 16, 2023
• dena h2o H2O vulnerable to read from uninitialized pointer in the reverse proxy handler CVE-2023-30847 8.2 HighApril 27, 2023
• dena h2o Unititialized memory access in h2o CVE-2021-43848 Public exploit 7.4 HighFebruary 1, 2022
• dena h2o Buffer overflow in H2O version 2.2.4 and earlier allows remote attackers to execute arbitrary... CVE-2018-0608 Fix available 9.8 CriticalJune 26, 2018
• Show olderLoading…