Security advisory

{
  "id": "d142f3739c2b72e35de77a4d8bfb9f022138ea41d3f0ab36231e5c684c0fc1d4",
  "url": "https://osv.dev/vulnerability/CVE-2016-4817",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "CVE-2016-4817",
    "summary": "lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.",
    "evidence": "osv:CVE-2016-4817",
    "products": [],
    "severity": "high",
    "structured": {
      "id": "CVE-2016-4817",
      "aliases": [
        "CVE-2016-4817"
      ],
      "metrics": [
        {
          "type": "CVSS_V3",
          "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
        }
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://github.com/h2o/h2o",
              "type": "GIT",
              "events": [
                {
                  "introduced": "0"
                },
                {
                  "last_affected": "822f6696f5a380d42b2125f3530e2ca997d16d95"
                },
                {
                  "last_affected": "788d3dcf683f65acc43a0dd81a75d697574b7656"
                },
                {
                  "fixed": "1c0808d580da09fdec5a9a74ff09e103ea058dd4"
                }
              ],
              "database_specific": {
                "extracted_events": [
                  {
                    "cpe": "cpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "1.7.2"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "cpe": "cpe:2.3:a:dena:h2o:*:beta4:*:*:*:*:*:*",
                    "range": [
                      {
                        "introduced": "0"
                      },
                      {
                        "last_affected": "2.0.0"
                      }
                    ],
                    "source": "CPE_RANGE"
                  },
                  {
                    "range": [
                      {
                        "fixed": "1c0808d580da09fdec5a9a74ff09e103ea058dd4"
                      }
                    ],
                    "source": "REFERENCES_COMMIT"
                  }
                ]
              }
            }
          ],
          "versions": [
            "v2.0.0",
            "v2.0.0-beta5",
            "v2.0.0-beta4",
            "v1.7.2",
            "v2.0.0-beta3",
            "v2.0.0-beta2",
            "v1.7.1",
            "v2.0.0-beta1",
            "v1.7.0",
            "v1.7.0-beta5",
            "v1.7.0-beta4",
            "v1.7.0-beta3",
            "v1.7.0-beta2",
            "v1.7.0-beta1",
            "v1.6.0",
            "v1.6.0-beta2",
            "v1.6.0-beta1",
            "v1.5.3",
            "v1.5.2",
            "v1.5.1",
            "v1.5.0",
            "v1.5.0-beta4",
            "v1.5.0-beta3",
            "v1.5.0-beta2",
            "v1.5.0-beta1",
            "v1.4.2",
            "v1.4.1",
            "v1.4.0",
            "v1.3.1",
            "v1.3.0",
            "v1.3.0-beta1",
            "v1.2.0",
            "v1.1.1",
            "v1.1.0",
            "v1.0.1",
            "v0.9.2",
            "v0.9.1"
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4817.json",
            "vanir_signatures": [
              {
                "id": "CVE-2016-4817-59daa686",
                "digest": {
                  "threshold": 0.9,
                  "line_hashes": [
                    "329239125789124087182915064940731376125",
                    "266309510554630169712264012537103885330",
                    "197975614374828376140268295922414557673",
                    "88220809129850639336858084392335629537",
                    "264420450238353059047339551284803211427",
                    "105768331291502333328196447212649985142",
                    "101985462780240376266675775266166062940",
                    "16853485741457918660628260381936812258",
                    "288713173150179118716946275085263877024",
                    "289826459888828424977032830879727587397",
                    "60174033087969577437234742526071942338",
                    "199625314356774529948513761081529147428",
                    "209835943162243931517005908515314847205",
                    "274342591813652804326888717120840676412",
                    "60017146153803948156149809713385384696",
                    "61231778414654015687969942411931505954",
                    "323220998124955799820809640371820826541",
                    "83630824525165648455721562733994244144",
                    "29993085774509740062677308642609663815",
                    "188889563878087960953354398331796175930",
                    "129776294623353418334243229886839028024",
                    "12779954271799651926114189920953886087",
                    "328555839365560475332753126823504737131",
                    "75534149408212975149345679727818638341",
                    "309593389191819227610748371966607787432",
                    "28627878095721931108278994499449785225",
                    "71803716231536038745320003104207006781",
                    "289130918354319889562547388440406977231",
                    "275162912589252339225434569048670363574",
                    "291958405221619009527991290958432627218",
                    "295195926032936637007314322432550540456",
                    "192071179894503489437241386203404076195",
                    "280085862657928528487581404240480500535"
                  ]
                },
                "source": "https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4",
                "target": {
                  "file": "lib/http2/connection.c"
                },
                "deprecated": false,
                "signature_type": "Line",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-4817-5e1a9eba",
                "digest": {
                  "length": 218,
                  "function_hash": "9254488288664784072808278735934685341"
                },
                "source": "https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4",
                "target": {
                  "file": "lib/http2/connection.c",
                  "function": "close_connection"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-4817-c51e6c3b",
                "digest": {
                  "length": 325,
                  "function_hash": "340094519555268223943403087251481593318"
                },
                "source": "https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4",
                "target": {
                  "file": "lib/http2/connection.c",
                  "function": "on_read"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              },
              {
                "id": "CVE-2016-4817-d83e6edc",
                "digest": {
                  "length": 1165,
                  "function_hash": "133981974142536589208943285040293713390"
                },
                "source": "https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4",
                "target": {
                  "file": "lib/http2/connection.c",
                  "function": "parse_input"
                },
                "deprecated": false,
                "signature_type": "Function",
                "signature_version": "v1"
              }
            ],
            "vanir_signatures_modified": "2026-10-20T13:17:07Z"
          }
        }
      ],
      "modified": "2026-10-20T13:17:07.889161097Z",
      "provider": "osv",
      "references": [
        "https://github.com/h2o/h2o/pull/920",
        "https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4"
      ],
      "provider_metadata": {}
    },
    "related_cves": [
      {
        "value": "CVE-2016-4817",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": "/severity/0/score"
  },
  "source_id": "core-osv",
  "document_id": 387449,
  "published_at": "2016-06-19T01:59:11.903+00:00"
}