PatchTheCVECVE-2024-25622: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3
CVE-2024-25622 is a low-severity flaw (CVSS 3.1) affecting h2o. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer s
Why this priority
- Public exploit reference
A fixed release or distro patch exists.
Risk facts
| CVSS score | 3.1 (Low) |
| Attack vector | Network (remote) |
| Attack complexity | High |
| Privileges needed | None |
| User interaction | Required |
| EPSS exploit chance | 0.5% (top 60%) |
| CISA exploited list | No |
| Weakness | CWE-670 |
| Published | 2024-10-11 |
| Last modified | 2026-06-17 |
Last updated 2026-06-17 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Am I affected?
Timeline
- Published CVE record published
- Updated Record last modified
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2024-25622?
h2o: upgrade to newer than 2024-02-11. Exact commands for each OS are on this page.
Is CVE-2024-25622 being exploited?
CVE-2024-25622 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2024-25622 affect?
CVE-2024-25622 affects h2o. Severity is low (CVSS 3.1). h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and th
How urgent is CVE-2024-25622?
Priority 26/100. Public exploit reference
Related CVEs
- CVE-2026-3960 CRITICAL 9.8 UPGRADE A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTa
- CVE-2026-8751 HIGH 7.3 UPGRADE A security flaw has been discovered in h2oai h2o-3 up to 7402
- CVE-2026-8750 MEDIUM 5.3 UPGRADE A vulnerability was identified in h2oai h2o-3 up to 7402
- CVE-2026-8752 MEDIUM 5.3 UPGRADE A weakness has been identified in h2oai h2o-3 up to 7402
- CVE-2025-6544 CRITICAL 9.8 UPGRADE A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitra