https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-45403.htmlhttps://patchthecve.com/cve/CVE-2024-45403.htmlWed, 17 Jun 2026 07:54:08 +0000LOW 3.7: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When h2o is configured as a reverse proxy and HTTP/3 requests are cancelled by the client, h2o might crash due to an assertion failure. The crash can be exploited by an attacker to mount a Denial-of-Service attack. By default, the hhttps://patchthecve.com/cve/CVE-2024-45402.htmlhttps://patchthecve.com/cve/CVE-2024-45402.htmlWed, 17 Jun 2026 07:54:08 +0000HIGH 8.6: Picotls is a TLS protocol library that allows users select different crypto backends based on their use case. When parsing a spoofed TLS handshake message, picotls (specifically, bindings within picotls that call the crypto libraries) may attempt to free the same memory twice. This double free occurhttps://patchthecve.com/cve/CVE-2024-45397.htmlhttps://patchthecve.com/cve/CVE-2024-45397.htmlWed, 17 Jun 2026 07:54:08 +0000MEDIUM 5.9: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. When an HTTP request using TLS/1.3 early data on top of TCP Fast Open or QUIC 0-RTT packets is received and the IP-address-based access control is used, the access control does not detect and prohibit HTTP requests conveyed by packehttps://patchthecve.com/cve/CVE-2024-45396.htmlhttps://patchthecve.com/cve/CVE-2024-45396.htmlWed, 17 Jun 2026 07:54:08 +0000HIGH 7.5: Quicly is an IETF QUIC protocol implementation. Quicly up to commtit d720707 is susceptible to a denial-of-service attack. A remote attacker can exploit these bugs to trigger an assertion failure that crashes process using quicly. The vulnerability is addressed with commit 2a95896104901589c495bc4146https://patchthecve.com/cve/CVE-2024-25622.htmlhttps://patchthecve.com/cve/CVE-2024-25622.htmlWed, 17 Jun 2026 07:16:18 +0000LOW 3.1: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit thhttps://patchthecve.com/cve/CVE-2023-50247.htmlhttps://patchthecve.com/cve/CVE-2023-50247.htmlWed, 17 Jun 2026 06:39:22 +0000LOW 3.7: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The QUIC stack (quicly), as used by H2O up to commit 43f86e5 (in version 2.3.0-beta and prior), is susceptible to a state exhaustion attack. When H2O is serving HTTP/3, a remote attacker can exploit this vulnerability to progressivehttps://patchthecve.com/cve/CVE-2023-41337.htmlhttps://patchthecve.com/cve/CVE-2023-41337.htmlWed, 17 Jun 2026 06:21:51 +0000MEDIUM 6.1: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. In version 2.3.0-beta2 and prior, when h2o is configured to listen to multiple addresses or ports with each of them using different backend servers managed by multiple entities, a malicious backend entity that also has the opportuni