CVE-2026-54340
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk20th percentile - higher than 20% of all known CVEs
Summary
In the h2o HTTP server prior to commit 9265bdd, there is an HTTP/2 state amplification vulnerability that combines HPACK decompression amplification with Slowloris-style stream stalling. Decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack.
Risk Assessment
An attacker can exploit this vulnerability to overload the server by keeping large amounts of decoded headers in memory, leading to resource exhaustion and potential denial of service (DoS).
Recommendation
Immediately update the h2o server to a version containing commit 9265bdd or later. Additionally, depending on the configuration, consider implementing limits on decoded header state.
Other vulnerabilities in h2o
See all- CVE-2017-10908High
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
- CVE-2017-10869High
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
- CVE-2017-10868High
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
- CVE-2016-4864High
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allow remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
- CVE-2016-4817High
In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.
- CVE-2016-7835Critical
A use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
- CVE-2026-44453High
The h2o HTTP server prior to commit 6b5370d is vulnerable to a Denial of Service attack due to excessive stack memory allocation via alloca. When serving static files, the allocation size can reach ~600KB, exceeding the default pthread stack size in musl libc (128KB), causing a segmentation fault and server crash.
- CVE-2026-44452Medium
A vulnerability in the h2o HTTP server prior to commit 8dc37cb causes an out-of-bounds read when processing a ClientHello message over TLS or QUIC containing a zero-length SNI extension. This can lead to a segmentation violation and potential denial-of-service (DoS) attack.
- CVE-2026-55213High
A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.
Original NVD description (English source)
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.