h2o HTTP/3 Reverse Proxy Assertion Failure Denial-of-Service Vulnerability

An assertion failure vulnerability has been identified in the h2o HTTP server when it is configured as a reverse proxy and handling HTTP/3 requests. If a client cancels an HTTP/3 request, h2o may crash due to the assertion failure. This crash can be exploited to disrupt service, causing a denial-of-service condition. Although the h2o standalone server typically restarts automatically, minimizing the disruption, concurrent HTTP requests that were being served will still be interrupted. The vulnerability affects h2o versions between commits 16b13ee and 15ed15a.

Impact

Exploitation of this vulnerability leads to a crash of the h2o server process, causing a denial-of-service condition. While the server can automatically restart, any ongoing HTTP requests will be disrupted.

Reproduction

To reproduce this vulnerability, configure the h2o server to use HTTP/3 with QUIC enabled. Set up the server as a reverse proxy. Once the server is running, send an HTTP/3 request through the proxy and then cancel it. This will trigger the assertion failure, causing the server to crash.

Remediation

Users can upgrade to h2o commit 1ed32b2 or later to address this vulnerability. Alternatively, HTTP/3 can be disabled by removing or commenting out the listen directives that use the quic type or attribute.