CVE-2026-44452
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
A vulnerability in the h2o HTTP server prior to commit 8dc37cb causes an out-of-bounds read when processing a ClientHello message over TLS or QUIC containing a zero-length SNI extension. This can lead to a segmentation violation and potential denial-of-service (DoS) attack.
Risk Assessment
An attacker can send a crafted TLS/QUIC request with an empty SNI, causing the server to crash and disrupting service. All h2o instances exposed to network traffic are at risk.
Recommendation
Immediately update h2o to a version containing commit 8dc37cb or later. If an update is not possible, consider temporarily disabling SNI support or applying WAF rules to block empty SNI extensions.
Other vulnerabilities in h2o
See all- CVE-2017-10908High
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
- CVE-2017-10869High
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
- CVE-2017-10868High
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
- CVE-2016-4864High
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allow remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
- CVE-2016-4817High
In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.
- CVE-2016-7835Critical
A use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
- CVE-2026-54340High
In the h2o HTTP server prior to commit 9265bdd, there is an HTTP/2 state amplification vulnerability that combines HPACK decompression amplification with Slowloris-style stream stalling. Decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack.
- CVE-2026-44453High
The h2o HTTP server prior to commit 6b5370d is vulnerable to a Denial of Service attack due to excessive stack memory allocation via alloca. When serving static files, the allocation size can reach ~600KB, exceeding the default pthread stack size in musl libc (128KB), causing a segmentation fault and server crash.
- CVE-2026-55213High
A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.
Original NVD description (English source)
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.