High severity7.5NVD Advisory· Published Jun 19, 2016· Updated May 6, 2026

CVE-2016-4817

Description

lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.

Affected products

Dena/H2o2 versions
cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*range: <=1.7.2
- cpe:2.3:a:dena:h2o:*:beta4:*:*:*:*:*:*range: <=2.0.0

Patches

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

jvn.jp/en/jp/JVN87859762/index.htmlnvdVendor Advisory
jvndb.jvn.jp/jvndb/JVNDB-2016-000091nvdVendor Advisory
github.com/h2o/h2o/pull/920nvdVendor Advisory
github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4nvd

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000