CVE-2023-30847 json
H2O vulnerable to read from uninitialized pointer in the reverse proxy handler
published 2023-04-27 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-35199
- cvss
- 8.2
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.
Patch / fix
- github.com/h2o/h2o@f010336 commit
- github.com/h2o/h2o#3229 pull request
- github.com/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx advisory
CISA SSVC
- Exploitation
- none
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
0.90% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
| NVD | 3.1 | 8.2 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H |
Affected products
- h2o h2o
Classification
- Weakness
-
- CWE-824 Access of Uninitialized Pointer
References
-
github.com
/h2o/h2o/pull/3229
vendor-advisory
-
github.com
/h2o/h2o/commit/f010336bab162839df43d9e87570897466c97e33
patch
-
github.com
/h2o/h2o/security/advisories/GHSA-p5hj-phwj-hrvx
patch, vendor-advisory
Sources
- CVE List CVE-2023-30847
- NVD CVE-2023-30847
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.