VulnSocial

CVE-2023-50247General(dena / h2o)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressively increase the memory retained by the QUIC stack. This can eventually cause H2O to abort due to memory exhaustion. The vulnerability has been resolved in commit d67e81d03be12a9d53dc8271af6530f40164cd35. HTTP/1 and HTTP/2 are not affected by this vulnerability as they do not use QUIC. Administrators looking to mitigate this issue without upgrading can disable HTTP/3 support.

dena CVEsBack to dashboard
0.0/ 10 priority

Sources & remediation

Patch / fix
Weakness type (CWE)
CWE-770

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

AVAILABLE

Momentum

NONE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • h2o

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • General: 1 classified signal
  • 1 total mentions across 1 day

Affected systems

Vendors
dena
Products
h2o

1 version affected across 1 product

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-07-21: 107-21
Signal classification1 categories
General
1100.0%
Full discourse1 post
  • 𝔸𝕟𝕠𝕟𝕪𝕞𝕠𝕦𝕤 ℍ𝕒𝕔𝕜𝕥𝕚𝕧𝕚𝕤𝕥☭⃠🅇@YourAnon_irc
    General

    Recent CVEs (July 21, 2026) impact network security. D-Link DNS-320 has an unrestricted upload vulnerability. H2O/QUIC DoS (CVE-2023-50247, CVE-2024-45396) and TLS/QUIC IP spoofing (CVE-2024-45397) risk data integrity & privacy in transit. #Cybersecurity #Vulnerabilities #News

    Post summary

    The statement lists several CVEs and mentions a general vulnerability with no supporting PoC, exploit, patch, or detailed technical information.

    0000068
    15 followersView on X
CPE platform detail3 entries

3 of 3 entries

PartVendorProductVersionTarget SWTarget HW
Appdenah2o---
Appdenah2o2.3.0--
Appdenah2o2.3.0--

Explore more

Back to dashboarddena CVEsh2o vulnerabilities