Use-After-Free Vulnerability in H2O Web Server by Kazuho Kurosawa
CVE-2016-7835

9.1CRITICAL

Key Information:

Vendor

Kazuho Oku

Status
H2o
Vendor
CVE Published:
9 June 2017

What is CVE-2016-7835?

A use-after-free vulnerability was identified in the H2O web server that can be exploited by remote attackers. This flaw may lead to a denial-of-service (DoS) condition, causing the web server to crash. Additionally, it may allow unauthorized access to sensitive information, including server certificate private keys. The vulnerability poses significant risks to server integrity and confidentiality, emphasizing the need for prompt updates and mitigation measures.

Affected Version(s)

H2O version 2.0.4 and earlier

References

http://www.securityfocus.com/bid/95061
vdb-entryx_refsource_BID
https://github.com/h2o/h2o/issues/1144
x_refsource_CONFIRM
https://jvn.jp/en/jp/JVN44566208/index.html
third-party-advisoryx_refsource_JVN

CVSS V3.1

Score:
9.1
Severity:
CRITICAL
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.