CVE catalog

CVE-2024-45397

h2o: CVE-2024-45397

Severity: Medium
Published: Oct 11, 2024, 3:15:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.44% · Oct 25, 2026

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	h2o	bookworm	`2.2.5+dfsg2-7`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2+esm1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-7`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu2`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu3`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	h2o	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1084984]

[Debian bug #1084984]

Notes

[bookworm] h2o: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[h2o]Affected
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
[h2o-doc]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
[libh2o0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
[libh2o-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
[libh2o-dev-common]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
[libh2o-evloop0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
[libh2o-evloop-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  dsa · h2o · debian · bookworm; dsa · h2o · debian · 12

Observed: Oct 27, 2026, 1:32:50 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]