Format string vulnerability exists in H2O upto and including version 2.0.3 / 2.1.0-beta2, that can be used by remote attackers to mount Denial-of-Service attacks.

Users using one of the following handlers of H2O may be affected by the issue and are advised to upgrade immediately to version 2.0.4 or 2.1.0-beta3.

Affected handlers:

• fastcgi
• mruby
• proxy
• redirect
• reproxy

Deployments only using the file handler is not affected by the vulnerability.