Security readout for executives and security teams
Plain-English summary
This issue affects only unreleased h2o HTTP/3 server builds from a specific development commit window. In those builds, crafted QUIC frame ordering could make h2o process uninitialized memory, potentially exposing sensitive internal data. Released h2o versions are reported unaffected.
Executive priority
Treat as high priority only if your organization runs unreleased, source-built h2o with HTTP/3 enabled. If using released h2o versions, current source evidence indicates no affected exposure.
Technical view
CVE-2021-43848 is CWE-908 uninitialized resource use in h2o's HTTP/3 server-side implementation. Vulnerable code may treat uninitialized memory as received HTTP/3 frames. Exposure is tied to HTTP/3 support in unreleased commits between 93af138 and d1f0f65, fixed by commit 8c0eca3.
Likely exposure
Likely exposure is narrow: organizations using source-built, unreleased h2o versions with HTTP/3 enabled in the affected commit range. Standard released h2o versions are reported unaffected by the advisory.
Exploitation context
The sources do not report active exploitation, and the CVE is not marked KEV. The advisory describes attacker-controlled QUIC frame ordering that could leak h2o internal state through reverse proxy backends or reflecting HTTP endpoints.
Researcher notes
Key uncertainty is environmental: exposure depends on exact source commit and HTTP/3 enablement. The source bundle provides vulnerability mechanics and fix commit, but no public exploit confirmation, no KEV listing, and no workaround beyond upgrading.
Mitigation direction
- Upgrade affected unreleased HTTP/3 builds to commit 8c0eca3 or later.
- Confirm production systems do not run h2o from commits 93af138 through d1f0f65.
- Follow h2o vendor guidance; the advisory names no workaround.
- Replace vulnerable source-built deployments before exposing HTTP/3 traffic.
Validation and detection
- Inventory h2o deployments and identify source-built or unreleased versions.
- Check whether HTTP/3 and QUIC support are enabled.
- Verify deployed source commit is outside the affected range.
- Review reverse proxy and reflector endpoints for possible sensitive data exposure.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-908: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-43848 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.4 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H2.25.2Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.4HighVector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/h2o/h2o/security/advisories/GHSA-f9xw-j925-m4m4CVE reference · x_refsource_CONFIRM
- https://github.com/h2o/h2o/commit/8c0eca3CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Use of Uninitialized Resource
Use of Uninitialized Resource represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.