H2O QUIC State Exhaustion Denial-of-Service Vulnerability

A denial-of-service vulnerability has been identified in the H2O HTTP server, specifically in versions through 2.3.0-beta, due to a state exhaustion issue in the QUIC stack (quicly) used by the server. When H2O is handling HTTP/3 requests, a remote attacker can exploit this vulnerability to gradually increase the memory usage of the QUIC stack, leading to memory exhaustion and causing H2O to crash. This vulnerability does not affect HTTP/1 or HTTP/2, as they do not utilize QUIC.

Impact

Exploitation of this vulnerability can cause H2O to terminate unexpectedly due to running out of available memory.

Remediation

To address this vulnerability, H2O users should update to version 2.3.0-beta or later. For those unable to upgrade, QUIC support can be disabled. Guidance on HTTP/3 configuration directives is available in the H2O documentation.