Utrenkner

**Name of the Vulnerable Software and Affected Versions** h2o versions prior to the version containing commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be **Description** h2o is an HTTP server with support for HTTP/1.x, HTTP/2, and HTTP/3. The configuration directives provided by the headers handler allow users to modify the response headers being sent by h2o. The configuration file of h2o has scopes, and the inner scopes are expected to inherit the configuration defined in outer scopes. However, if a header directive is used in the inner scope, all the definitions in outer scopes are ignored. This can lead to headers not being modified as expected, potentially causing unexpected client behavior due to added or removed headers. **Recommendations** For versions prior to the version containing commit 123f5e2b65dcdba8f7ef659a00d24bd1249141be, update to a version that includes this commit to resolve the issue. As a temporary workaround, consider reviewing and adjusting the configuration directives in the headers handler to minimize the risk of unexpected client behavior. Restrict access to sensitive areas of the configuration file to prevent unintended modifications.