Описание
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
| Релиз | Статус | Примечание |
|---|---|---|
| devel | not-affected | no longer depends on h2o |
| esm-apps-legacy/xenial | not-affected | dns over https not implemented |
| esm-apps/bionic | not-affected | dns over https not implemented |
| esm-apps/focal | not-affected | uses system h2o |
| esm-apps/jammy | not-affected | uses system h2o |
| esm-apps/noble | needs-triage | |
| esm-apps/resolute | not-affected | no longer depends on h2o |
| jammy | not-affected | uses system h2o |
| noble | needs-triage | |
| resolute | not-affected | no longer depends on h2o |
Показывать по
| Релиз | Статус | Примечание |
|---|---|---|
| devel | DNE | |
| esm-apps/bionic | needs-triage | |
| esm-apps/focal | needs-triage | |
| esm-apps/jammy | needs-triage | |
| esm-apps/noble | needs-triage | |
| jammy | needs-triage | |
| noble | needs-triage | |
| resolute | DNE | |
| upstream | needs-triage |
Показывать по
EPSS
7.5 High
CVSS3
Связанные уязвимости
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Pr ...
EPSS
7.5 High
CVSS3