CVE-2024-45403: Dena H2o HTTP/3 DoS Vulnerability

CVE-2024-45403 Overview

CVE-2024-45403 is a denial-of-service vulnerability in the h2o HTTP server maintained by DeNA. The flaw affects deployments where h2o operates as a reverse proxy handling HTTP/3 traffic. When a client cancels an in-flight HTTP/3 request, the server can trigger an assertion failure and crash. The issue is classified under CWE-617: Reachable Assertion and impacts service availability without exposing data confidentiality or integrity.

Critical Impact
Remote unauthenticated attackers can crash the h2o reverse proxy process by cancelling HTTP/3 requests, disrupting all concurrent connections served by that worker.

Affected Products

DeNA h2o HTTP server with HTTP/3 enabled
h2o instances configured as reverse proxies
Builds prior to commit 1ed32b23f999acf0c5029f09c8525f93eb1d354c

Discovery Timeline

2024-10-11 - CVE-2024-45403 published to NVD
2024-11-12 - Last updated in NVD database

Technical Details for CVE-2024-45403

Vulnerability Analysis

The vulnerability resides in the HTTP/3 request handling path of h2o when operating as a reverse proxy. h2o supports HTTP/1.x, HTTP/2, and HTTP/3 protocols on its front-end listener. When a client cancels an HTTP/3 stream mid-flight, h2o reaches an internal state that violates a runtime assertion. The assertion failure terminates the server process abruptly.

While the standalone h2o server is designed to auto-restart after a crash, all concurrent HTTP requests served by the affected worker process are disrupted. Repeated triggering of the assertion allows an attacker to sustain a denial-of-service condition against the proxy.

Root Cause

The root cause is a reachable assertion in the HTTP/3 stream cancellation logic. The server fails to gracefully handle the state transition triggered by client-initiated request cancellation when forwarding traffic upstream as a reverse proxy. Rather than returning an error or cleanly tearing down the stream, the code path hits assert() and aborts the process.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker establishes an HTTP/3 (QUIC) connection to the h2o reverse proxy, initiates a request that gets forwarded upstream, and then cancels the request before completion. The cancellation path triggers the assertion failure. Because HTTP/3 over UDP is the prerequisite, deployments without HTTP/3 enabled are not affected. The vulnerability mechanism is described in the GitHub Security Advisory GHSA-4xp5-3jhc-3m92.

Detection Methods for CVE-2024-45403

Indicators of Compromise

Repeated unexpected restarts of the h2o process in system logs or supervisor output
Assertion failure messages or SIGABRT signals recorded in crash logs or core dumps
Spikes in HTTP/3 connection attempts followed by rapid stream cancellations from the same source
Brief outages or 5xx errors reported by upstream monitoring during HTTP/3 traffic patterns

Detection Strategies

Monitor h2o service uptime and restart counts; frequent restarts within short windows indicate exploitation attempts
Inspect QUIC and HTTP/3 telemetry for abnormal ratios of cancelled streams per source IP
Correlate process termination events with concurrent HTTP/3 traffic patterns to identify malicious sources

Monitoring Recommendations

Enable verbose logging on the h2o process supervisor to capture exit codes and timestamps
Forward host-level process events and crash artifacts to a centralized SIEM for correlation
Set alerting thresholds on repeated h2o restarts within configurable time windows

How to Mitigate CVE-2024-45403

Immediate Actions Required

Upgrade h2o to a build that includes commit 1ed32b23f999acf0c5029f09c8525f93eb1d354c from the official h2o repository
If patching is not immediate, disable HTTP/3 in the h2o configuration to remove the affected code path
Audit reverse proxy configurations and inventory all h2o instances exposed to untrusted networks

Patch Information

The upstream fix is delivered in commit 1ed32b2 with a related update in commit 16b13eee8ad7895b4fe3fcbcabee53bd52782562. Refer to the h2o security advisory GHSA-4xp5-3jhc-3m92 for the authoritative patch reference and rebuild instructions.

Workarounds

Disable HTTP/3 listeners by removing the listen block configured for QUIC in h2o.conf
Restrict UDP/443 ingress at the network perimeter to block HTTP/3 traffic until patching
Place a patched HTTP/3-capable proxy or load balancer in front of h2o to terminate QUIC traffic

bash

# Disable HTTP/3 in h2o.conf by removing the QUIC listener block
# Reference: https://h2o.examp1e.net/configure/http3_directives.html
# Example - keep TCP/443 listener, remove the UDP/QUIC listener:
listen:
  port: 443
  ssl:
    certificate-file: /path/to/cert.pem
    key-file: /path/to/key.pem
# (No corresponding 'listen' block with 'type: quic')

# Then reload h2o:
sudo systemctl reload h2o