CVE catalog

CVE-2021-43848

h2o: CVE-2021-43848

Severity: Low
Published: Feb 1, 2022, 1:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 2.67% · Oct 25, 2026

h2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o. This internal state includes traffic of other connections in unencrypted form and TLS session tickets. This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability. There are no known workarounds. Users of unreleased versions of h2o using HTTP/3 are advised to upgrade immediately.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	h2o	bookworm	`2.2.5+dfsg2-7`	not affected
Ubuntu	h2o	pro	`2.2.5+dfsg2-6`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2+esm1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-7`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu2`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	h2o	source	bookworm	`Not affected`	unimportant	Not reported	Not reported

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[h2o]Not affected
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
[h2o-doc]Not affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · all · bookworm
  Not affected
  dsa · h2o · debian · bookworm
[libh2o0.13]Not affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
[libh2o-dev]Not affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
[libh2o-dev-common]Not affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · all · bookworm
  Not affected
  dsa · h2o · debian · bookworm
[libh2o-evloop0.13]Not affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
[libh2o-evloop-dev]Not affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Not affected
  dsa · h2o · debian · bookworm

Observed: Oct 23, 2026, 6:03:29 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]