CVE-2023-30847

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

H2O is an HTTP server. In versions 2.3.0-beta2 and prior, when the reverse proxy handler tries to processes a certain type of invalid HTTP request, it tries to build an upstream URL by reading from uninitialized pointer. This behavior can lead to crashes or leak of information to back end HTTP servers. Pull request number 3229 fixes the issue. The pull request has been merged to the `master` branch in commit f010336. Users should upgrade to commit f010336 or later.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-824

Affected software

No affected versions have been published.

Timeline

Published: Apr 27, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-308488.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the admin search find API has a SQL injection v CVE-2023-308498.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, A SQL injection vulnerability exists in the tra CVE-2023-30856.1A vulnerability, which was classified as problematic, has been found in X-WRT luci up to 22.10_b202303061504. This issue affects the functio CVE-2023-308508.8Pimcore is an open source data and experience management platform. Prior to version 10.5.21, a SQL Injection vulnerability exists in the adm CVE-2023-308515.3Cilium is a networking, observability, and security solution with an eBPF-based dataplane. This issue only impacts users who have a HTTP pol CVE-2023-308524.9Pimcore is an open source data and experience management platform. Prior to version 10.5.21, the `/admin/misc/script-proxy` API endpoint tha CVE-2023-308536.5Gradle Build Action allows users to execute a Gradle Build in their GitHub Actions workflow. A vulnerability impacts GitHub workflows using CVE-2023-308548.8AVideo is an open source video platform. Prior to version 12.4, an OS Command Injection vulnerability in an authenticated endpoint `/plugin/CVE-2023-308557.5Pimcore is an open source data and experience management platform. Versions of Pimcore prior to 10.5.18 are vulnerable to path traversal. Th CVE-2023-3085610.0eDEX-UI is a science fiction terminal emulator. Versions 2.2.8 and prior are vulnerable to cross-site websocket hijacking. When running eDEX CVE-2023-308573.7@aedart/support is the support package for Ion, a monorepo for JavaScript/TypeScript packages. Prior to version `0.6.1`, there is a possible CVE-2023-308587.5The Denosaurs emoji package provides emojis for dinosaurs. Starting in version 0.1.0 and prior to version 0.3.0, the reTrimSpace regex has 2