Is CVE-2024-25622 actively exploited?

CVE-2024-25622 has no public evidence of in-the-wild exploitation as of 2024-11-12.

What is the CVSS score for CVE-2024-25622?

CVE-2024-25622 has a CVSS score of 3.1 (LOW severity). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N.

How do I patch CVE-2024-25622?

Patch guidance is available from dena security advisories. CVEDatabase generates AI-assisted remediation guidance on demand for CVE-2024-25622.

CVE-2024-25622 - remediation guidance & executive summary

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The configuration directives provided by the headers handler allows users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes (e.g., path level) are expected to inherit the configuration defined in outer scopes (e.g., global level). However, if a header directive is used in the inner scope, all the definition in outer scopes are ignored. This can lead to headers not being modified as expected. Depending on the headers being added or removed unexpectedly, this behavior could lead to unexpected client behavior. This vulnerability is fixed in commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be.

CVSS Metrics

Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
Attack Vector: network
Complexity: high
Privileges: none
User Action: required
Scope: unchanged
Confidentiality: low
Integrity: none
Availability: none
Weaknesses: CWE-670 CWE-670

Metadata

Primary Vendor: DENA
Published: 10/11/2024
Last Modified: 11/12/2024
Source: NIST NVD
Note: Verify all details with official vendor sources before applying patches.

Affected Products

dena : h2o

Remediation Guidance

Executive Summary

Cite this page

CVE-2024-25622. CVEDatabase.com. Retrieved 1 May 2026. https://cvedatabase.com/cve/CVE-2024-25622

View on NIST NVD

CVE-2024-25622 vulnerability