CVE-2024-25622

mediumpriority · track · 17EPSS 0.005 · 40 %ileEUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

0.46% (40th) EPSS

CVSS 4.3 · medium

Is it mine?

2 products

Check your exposure

Who says so?

3 sources

cnnvd · enisa_euvd · nvd

EPSS · scored 2026-10-28

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be.

cvss

Technical severity, 0–10. One row per scoring source.

4.3

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · low–medium · 3.1–4.3

v3.14.3mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 2.8 · impact 1.4

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · ENISA EU

v3.13.1lowCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:Nsecondary · security-advisories@github.comexploitability 1.6 · impact 1.4

v3.14mediumCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Trackcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-670USprimary

affected products (2)

Products and version ranges known to be affected.

h2o H2O≤ < 123f5e2b65dcdba8f7ef659a00d24bd1249141beenisa_euvdEU
dena h2o≤ 2024-02-11nvdUScpe:2.3:a:dena:h2o:*:*:*:*:*:*:*:*

also known as (2)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd nvd NVD CVE.org MITRE

published 2024-10-11modified 2026-06-17

related (576)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2024-32896US	high7.8OT critical	2.99% (87th)	KEV	2024-06-13
there is a possible way to bypass due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interacti…
CVE-2020-28052US	high8.1	7.22% (94th)	Exploit	2020-12-18
An issue was discovered in Legion of the Bouncy Castle BC Java 1.65 and 1.66. The OpenBSDBCrypt.checkPassword utility method compared incorrect data when checking the password, all…
CVE-2023-0400US	high8.2	0.42% (36th)	Exploit	2023-02-02
The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading sensitive data from…
CVE-2026-35414US	high8.1	0.21% (12th)	Exploit	2026-04-02
OpenSSH before 10.3 mishandles the authorized_keys principals option in uncommon scenarios involving a principals list in conjunction with a Certificate Authority that makes certai…
CVE-2026-38361US	high7.5	2.64% (86th)	Exploit	2026-05-08
Multiple unauthenticated denial-of-service (DoS) issues in fohrloop dash-uploader v0.1.0 through v0.7.0a2. The chunked-upload handler (dash_uploader/httprequesthandler.py, dash_upl…

+571 more

references (10)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan