CyberRota Analysis
AI-GeneratedAn amplification vulnerability exists in the h2o HTTP server related to HTTP/2, where HPACK decompression can be exploited in conjunction with Slowloris-style stream stalling, potentially allowing attackers to retain excessive decoded header state. This could lead to resource exhaustion and denial of service, particularly affecting server performance under certain configurations. Organizations using h2o should prioritize applying the fix to mitigate the risk of exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.
Related CVEs
Other vulnerabilities affecting the same vendor(s)