Django REST framework

Vulnerability Instance

Lookup for vulnerabilities affecting packages.

Vulnerability_idVCID-bja7-a3uf-zqer
Summaryh2o is an open source http server. In code prior to the `8c0eca3` commit h2o may attempt to access uninitialized memory. When receiving QUIC frames in certain order, HTTP/3 server-side implementation of h2o can be misguided to treat uninitialized memory as HTTP/3 frames that have been received. When h2o is used as a reverse proxy, an attacker can abuse this vulnerability to send internal state of h2o to backend servers controlled by the attacker or third party. Also, if there is an HTTP endpoint that reflects the traffic sent from the client, an attacker can use that reflector to obtain internal state of h2o. This internal state includes traffic of other connections in unencrypted form and TLS session tickets. This vulnerability exists in h2o server with HTTP/3 support, between commit 93af138 and d1f0f65. None of the released versions of h2o are affected by this vulnerability. There are no known workarounds. Users of unreleased versions of h2o using HTTP/3 are advised to upgrade immediately.
Aliases
0
alias CVE-2021-43848
Fixed_packages
0
url pkg:deb/debian/h2o@0?distro=bullseye
purl pkg:deb/debian/h2o@0?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/h2o@0%3Fdistro=bullseye
1
url pkg:deb/debian/h2o@2.2.5%2Bdfsg2-6?distro=bullseye
purl pkg:deb/debian/h2o@2.2.5%2Bdfsg2-6?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/h2o@2.2.5%252Bdfsg2-6%3Fdistro=bullseye
2
url pkg:deb/debian/h2o@2.2.5%2Bdfsg2-7?distro=bullseye
purl pkg:deb/debian/h2o@2.2.5%2Bdfsg2-7?distro=bullseye
is_vulnerable false
affected_by_vulnerabilities
resource_url http://public2.vulnerablecode.io/packages/pkg:deb/debian/h2o@2.2.5%252Bdfsg2-7%3Fdistro=bullseye
Affected_packages
References
0
reference_url https://api.first.org/data/v1/epss?cve=CVE-2021-43848
reference_id
reference_type
scores
0
value 0.133
scoring_system epss
scoring_elements 0.94189
published_at 2026-04-21T12:55:00Z
1
value 0.133
scoring_system epss
scoring_elements 0.94136
published_at 2026-04-02T12:55:00Z
2
value 0.133
scoring_system epss
scoring_elements 0.94168
published_at 2026-04-11T12:55:00Z
3
value 0.133
scoring_system epss
scoring_elements 0.94169
published_at 2026-04-13T12:55:00Z
4
value 0.133
scoring_system epss
scoring_elements 0.94184
published_at 2026-04-16T12:55:00Z
5
value 0.133
scoring_system epss
scoring_elements 0.94126
published_at 2026-04-01T12:55:00Z
6
value 0.133
scoring_system epss
scoring_elements 0.94147
published_at 2026-04-04T12:55:00Z
7
value 0.133
scoring_system epss
scoring_elements 0.9415
published_at 2026-04-07T12:55:00Z
8
value 0.133
scoring_system epss
scoring_elements 0.94159
published_at 2026-04-08T12:55:00Z
9
value 0.133
scoring_system epss
scoring_elements 0.94163
published_at 2026-04-09T12:55:00Z
url https://api.first.org/data/v1/epss?cve=CVE-2021-43848
1
reference_url https://github.com/h2o/h2o/commit/8c0eca3
reference_id 8c0eca3
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:11:27Z/
url https://github.com/h2o/h2o/commit/8c0eca3
2
reference_url https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4
reference_id GHSA-f9xw-j925-m4m4
reference_type
scores
0
value 7.4
scoring_system cvssv3.1
scoring_elements CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
1
value Track
scoring_system ssvc
scoring_elements SSVCv2/E:N/A:N/T:P/P:M/B:A/M:M/D:T/2025-04-23T14:11:27Z/
url https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4
Weaknesses
0
cwe_id 908
name Use of Uninitialized Resource
description The product uses or accesses a resource that has not been initialized.
Exploits
Severity_range_score7.4 - 7.4
Exploitabilitynull
Weighted_severitynull
Risk_scorenull
Resource_urlhttp://public2.vulnerablecode.io/vulnerabilities/VCID-bja7-a3uf-zqer