h2o HTTP server memory exhaustion via capsules
The h2o web server can run out of memory and stop.
Summary
The h2o HTTP server can keep buffering an incomplete UDP relay capsule without any size limit, exhausting its memory. Servers that enable CONNECT-UDP relay and accept its requests are affected.
Affected when
- proxy.connect-udp enabled and accepting CONNECT-UDP requests
What to do
Update to a version that includes commit 4212ce114506a073505fd389db16ad2ba4e582a0.
Products and platforms
CVE IDs
Times
First published
First seen