CVE-2026-55213
HighCVSS 7.5Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes a crash when processing QPACK instructions over HTTP/3. The function in lib/http3/qpack.c allocates an on-stack buffer of approximately 800 KB using alloca, exceeding the default pthread stack size in musl libc and leading to a segmentation fault.
Risk Assessment
An attacker can send a crafted QPACK instruction, causing the h2o server to crash and resulting in a denial of service (DoS). The vulnerability affects systems using musl libc, such as Alpine Linux.
Recommendation
Immediately update the h2o server to a version containing commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 or later. If an update is not possible, consider increasing the default thread stack size or disabling HTTP/3.
Other vulnerabilities in h2o
See all- CVE-2017-10908High
H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.
- CVE-2017-10869High
Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.
- CVE-2017-10868High
H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.
- CVE-2016-4864High
H2O versions 2.0.3 and earlier and 2.1.0-beta2 and earlier allow remote attackers to cause a denial-of-service (DoS) via format string specifiers in a template file via fastcgi, mruby, proxy, redirect or reproxy.
- CVE-2016-4817High
In H2O before version 1.7.3 and 2.x before 2.0.0-beta5, there is a flaw in handling HTTP/2 disconnection, which can lead to denial of service (use-after-free and application crash) or potentially allow arbitrary code execution via a crafted packet.
- CVE-2016-7835Critical
A use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.
- CVE-2026-54340High
In the h2o HTTP server prior to commit 9265bdd, there is an HTTP/2 state amplification vulnerability that combines HPACK decompression amplification with Slowloris-style stream stalling. Decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack.
- CVE-2026-44453High
The h2o HTTP server prior to commit 6b5370d is vulnerable to a Denial of Service attack due to excessive stack memory allocation via alloca. When serving static files, the allocation size can reach ~600KB, exceeding the default pthread stack size in musl libc (128KB), causing a segmentation fault and server crash.
- CVE-2026-44452Medium
A vulnerability in the h2o HTTP server prior to commit 8dc37cb causes an out-of-bounds read when processing a ClientHello message over TLS or QUIC containing a zero-length SNI extension. This can lead to a segmentation violation and potential denial-of-service (DoS) attack.
Original NVD description (English source)
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.