h2o HTTP Server Zero-Length SNI Extension Vulnerability Leading to Denial-of-Service

A denial-of-service vulnerability has been identified in the h2o HTTP server, which supports HTTP/1.x, HTTP/2, and HTTP/3. The issue arises when the server receives a ClientHello message over TLS or QUIC that includes a zero-length SNI extension. In this scenario, the server incorrectly processes the zero-length hostname, leading to a potential segmentation violation. This vulnerability is present in h2o commits prior to 8dc37cb and has been fixed in the mentioned commit.

Impact

Exploitation of this vulnerability can cause a heap overrun, potentially leading to a segmentation violation.

Reproduction

The vulnerability can be reproduced by sending a ClientHello message over TLS or QUIC with a zero-length SNI extension to an h2o server running a vulnerable commit. This can be done using a QUIC client that allows for the manipulation of the SNI extension, such as the 'quicly' command-line tool, by specifying the '--ech-configs' option with a crafted configuration that includes a zero-length SNI.

Remediation

Users can update to h2o version 2.3.0 or later, where this vulnerability has been fixed.