CVE-2023-41337

CVE-2023-41337 describes a vulnerability in h2o, an HTTP server, specifically affecting versions 2.3.0-beta2 and prior when configured with host-level listen directives for multiple addresses/ports and backend servers managed by different entities. An attacker, already acting as a backend, can misdirect and observe HTTPS requests by exploiting how h2o handles TLS session resumption without binding session IDs to server-specific information. This vulnerability has a CVSS score of 6.7 (MEDIUM), indicating an attack vector requiring adjacent network access and low privileges, but with high impact on confidentiality and integrity. The attack relies on user interaction (TLS session resumption) and a specific, vulnerable h2o configuration. Currently, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage. A patch is available, and a workaround involves using global-level listen directives instead of host-level ones.