Vulnerability Information
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
h2o QUIC state exhaustion DoS
Vulnerability Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressively increase the memory retained by the QUIC stack. This can eventually cause H2O to abort due to memory exhaustion. The vulnerability has been resolved in commit d67e81d03be12a9d53dc8271af6530f40164cd35. HTTP/1 and HTTP/2 are not affected by this vulnerability as they do not use QUIC. Administrators looking to mitigate this issue without upgrading can disable HTTP/3 support.
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
Vulnerability Type
不加限制或调节的资源分配
Vulnerability Title
H2O 安全漏洞
Vulnerability Description
H2O是一个用于分布式、可扩展机器学习的内存平台。 H2O 43f86e5之前版本存在安全漏洞，该漏洞源于应用使用 QUIC 堆栈，远程攻击者利用该漏洞可以逐步增加 QUIC 堆栈保留的内存，最终会导致 H2O 内存耗尽而中止。
CVSS Information
N/A
Vulnerability Type
N/A