Reachable Assertion Affecting h2o/h2o package, versions [0,]
Threat Intelligence
EPSS
0.05% (17th
percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-UNMANAGED-H2OH2O-8184978
- published 13 Oct 2024
- disclosed 11 Oct 2024
- credit Unknown
Introduced: 11 Oct 2024
CVE-2024-45403 Open this link in a new tabHow to fix?
A fix was pushed into the master branch but not yet published.
Overview
Affected versions of this package are vulnerable to Reachable Assertion when the server is configured as a reverse proxy and client-initiated cancellations of HTTP/3 requests occur. An attacker can cause the server to crash by sending specially crafted cancellation requests.
Note: This vulnerability has been fixed since commit 1ed32b2
Workaround
To mitigate this issue, users can disable the use of HTTP/3.
To do so, remove or comment out the listen directives using the quic type or attribute.