CVE-2016-4817

Published June 19th, 2016

View on NVD ↗

CVSS v3

N/A

CVSS v2

MEDIUM

Affected

PROJECT

Description

lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.

h2o/h2o

H2O - the optimized HTTP/1, HTTP/2, HTTP/3 server

GitHub

11.5K