CVE-2021-43848
📋 TL;DR
This vulnerability in h2o HTTP server allows attackers to read uninitialized memory when HTTP/3 is enabled, potentially exposing internal server state including unencrypted traffic from other connections and TLS session tickets. Only affects unreleased development versions of h2o between specific commits when HTTP/3 support is enabled. No production releases are affected.
💻 Affected Systems
- h2o HTTP server
📦 What is this software?
H2o by Dena
⚠️ Risk & Real-World Impact
Worst Case
Attackers could obtain unencrypted traffic from other connections, TLS session tickets, and potentially other sensitive internal server state, leading to session hijacking, data exposure, and further attacks.
Likely Case
Information disclosure of internal server state including traffic from other connections when used as reverse proxy or with reflective endpoints.
If Mitigated
No impact if HTTP/3 is disabled or using released versions of h2o.
🎯 Exploit Status
Requires specific QUIC frame ordering and HTTP/3 enabled. No known public exploits.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Commit 8c0eca3 or later
Vendor Advisory: https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4
Restart Required: Yes
Instructions:
1. Update h2o to commit 8c0eca3 or later. 2. Rebuild from source if using development version. 3. Restart h2o service.
🔧 Temporary Workarounds
Disable HTTP/3
allDisable HTTP/3 support in h2o configuration
# In h2o.conf, ensure no HTTP/3 configuration is present or explicitly disable it
🧯 If You Can't Patch
- Disable HTTP/3 support immediately
- Isolate affected servers from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check if using h2o development version between commits 93af138 and d1f0f65 with HTTP/3 enabledCheck Version:
h2o --version or check git commit hash if built from sourceVerify Fix Applied:
Verify h2o is at commit 8c0eca3 or later and HTTP/3 is properly configured📡 Detection & Monitoring
Log Indicators:
- Unusual HTTP/3 connection patterns
- Memory access errors in logs
Network Indicators:
- Abnormal QUIC frame sequences
- Unexpected data in HTTP/3 streams
SIEM Query:
Search for h2o process memory errors or abnormal HTTP/3 traffic patterns