H2O Quicly Library Denial-of-Service Vulnerability Due to Improper Flow Control Management

A denial-of-service vulnerability has been identified in the H2O HTTP server's Quicly library, prior to version 8b178e6. The issue arises from the library's flow control mechanism, which allows an adversarial peer to exploit the system by sending STREAM frames with minimal data. This manipulation can trick the application into allocating excessive memory to handle out-of-order data, leading to memory exhaustion. The problem is exacerbated by the default stream concurrency settings in H2O, which can quadruple the memory usage per connection.

Impact

Exploitation of this vulnerability causes memory exhaustion, with the potential to significantly increase the memory allocated per connection, especially under the default settings of the H2O HTTP server.

Reproduction

The vulnerability can be reproduced by sending a QUIC STREAM frame with a single byte of data at the largest offset allowed. This can be done using a custom client that targets an H2O server instance running the vulnerable Quicly library. The server should be configured to handle streams in a way that allows the flow control exploit to impact memory allocation.

Remediation

Users can update to Quicly version 8b178e6 or later to address this vulnerability.