h2o HTTP/2 State Amplification Vulnerability

A state amplification vulnerability has been identified in the h2o HTTP server, affecting versions prior to commit 9265bdd. This issue arises from a combination of HPACK decompression amplification and Slowloris-style stream stalling, which can lead to an excessive retention of decoded header state by stalled HTTP/2 streams. Depending on the server's configuration, additional limits may be required to manage the decoded header state and mitigate the risk of such an attack.

Impact

Exploitation of this vulnerability can cause a denial-of-service condition by stalling HTTP/2 streams, allowing amplified decoded header state to accumulate and potentially overwhelm the server.

Reproduction

The vulnerability can be reproduced by sending a series of HTTP/2 requests that include a high number of headers, exceeding the default limit. This can be done using a tool like curl, configured to use HTTP/2, or by manually crafting HTTP/2 requests that exploit the HPACK decompression amplification and Slowloris-style stream stalling.

Remediation

Users can update to h2o version 9265bdd or later, where this vulnerability has been fixed.