CVE-2016-4864

Published: May 12, 2017Modified: May 13, 2026

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allows remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.

Affected (3)

Products: Dena: H2o

Dena

1 product

H2o

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Dena H2o	From 2.0.0 to 2.0.3
Dena H2o	Version 2.1.0
Dena H2o	Version 2.1.0 beta1

Related CWEs

CWE-134

Use of Externally-Controlled Format String

The product uses a function that accepts a format string as an argument, but the format string originates from an external source.

References (4)

https://github.com/h2o/h2o/issues/1077

Source: vultures@jpcert.or.jp

PatchThird Party Advisory

https://jvn.jp/en/jp/JVN94779084/index.html

Source: vultures@jpcert.or.jp

Third Party AdvisoryVDB Entry

https://github.com/h2o/h2o/issues/1077

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://jvn.jp/en/jp/JVN94779084/index.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryVDB Entry

Timeline

No history available yet.