CVE-2024-45397

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packets with a spoofed source address. This behavior allows attackers on the network to execute HTTP requests from addresses that are otherwise rejected by the address-based access control. The vulnerability has been addressed in commit 15ed15a. Users may disable the use of TCP FastOpen and QUIC to mitigate the issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-284 CWE-290

Affected software

No affected versions have been published.

Timeline

Published: Oct 11, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-453988.8Contao is an Open Source CMS. In affected versions a back end user with access to the file manager can upload malicious files and execute th CVE-2024-453996.1Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. In Indico prior to version CVE-2024-45407.5A flaw was found in Keycloak in OAuth 2.0 Pushed Authorization Requests (PAR). Client-provided parameters were found to be included in plain CVE-2024-454006.1ckeditor-plugin-openlink is a plugin for the CKEditor JavaScript text editor that extends the context menu with a possibility to open a link CVE-2024-454017.1stripe-cli is a command-line tool for the payment processor Stripe. A vulnerability exists in stripe-cli starting in version 1.11.1 and prio CVE-2024-454029.8Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS han CVE-2024-454037.5h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancel CVE-2024-454048.1OpenCTI is an open-source cyber threat intelligence platform. In versions below 6.2.18, because the function to limit the rate of OTP does n CVE-2024-454056.0`gix-path` is a crate of the `gitoxide` project (an implementation of `git` written in Rust) dealing paths and their conversions. Prior to v CVE-2024-454064.8Craft is a content management system (CMS). Craft CMS 5 stored XSS can be triggered by the breadcrumb list and title fields with user input.CVE-2024-454075.3Sunshine is a self-hosted game stream host for Moonlight. Clients that experience a MITM attack during the pairing process may inadvertantly CVE-2024-454086.5eLabFTW is an open source electronic lab notebook for research labs. An incorrect permission check has been found that could allow an authen