x/vulndb: potential Go vuln in github.com/h2o/h2o: CVE-2016-4817

[tatianab]

CVE-2016-4817 references github.com/h2o/h2o, which may be a Go module.

Description:
lib/http2/connection.c in H2O before 1.7.3 and 2.x before 2.0.0-beta5 mishandles HTTP/2 disconnection, which allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly execute arbitrary code via a crafted packet.

References:

• NIST: https://nvd.nist.gov/vuln/detail/CVE-2016-4817
• fix: h2o/h2o@1c0808d
• web: http://jvn.jp/en/jp/JVN87859762/index.html
• fix: fix use after free on premature connection close (CVE-2016-4817) h2o/h2o#920
• web: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000091
• Imported by: https://pkg.go.dev/github.com/h2o/h2o?tab=importedby

Cross references:

• Module github.com/h2o/h2o appears in issue x/vulndb: potential Go vuln in github.com/h2o/h2o: CVE-2021-43848 #284 NOT_GO_CODE
• Module github.com/h2o/h2o appears in issue x/vulndb: potential Go vuln in github.com/h2o/h2o: CVE-2023-30847 #1749 NOT_GO_CODE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/h2o/h2o
      vulnerable_at: 2.2.6+incompatible
      packages:
        - package: n/a
cves:
    - CVE-2016-4817
references:
    - fix: https://github.com/h2o/h2o/commit/1c0808d580da09fdec5a9a74ff09e103ea058dd4
    - web: http://jvn.jp/en/jp/JVN87859762/index.html
    - fix: https://github.com/h2o/h2o/pull/920
    - web: http://jvndb.jvn.jp/jvndb/JVNDB-2016-000091

[gopherbot]

Change https://go.dev/cl/540721 mentions this issue: data/excluded: batch add 135 excluded reports