CVE-2026-55367

h2o: heap exhaustion using capsules

High7.5EPSS 0.34%

Published: 4 Nov 2026
Updated: 5 Nov 2026
Reserved: 16 Jun 2026
Assigned by: GitHub_M

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

Scores

CVSS scores of CVE-2026-55367, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVDNVD · Received	3.1	High7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS (exploitation in 30 days): 0.34% · top 73% of all CVEs (6 Nov 2026)
CISA SSVC: Exploitation: none · Automatable: yes · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.

Weakness

CWE-770: Allocation of Resources Without Limits or Throttling (opens in a new tab)All about CWE-770 and its CVEs

Affected products

h2o · h2o
- affected < 4212ce114506a073505fd389db16ad2ba4e582a0

References (3)

https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c (opens in a new tab)x_refsource_CONFIRM
https://github.com/h2o/h2o/pull/3754 (opens in a new tab)x_refsource_MISC
https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0 (opens in a new tab)x_refsource_MISC

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2026-55367](https://trackcve.app/badge/CVE-2026-55367.svg)](https://trackcve.app/cve/CVE-2026-55367)

Record last updated 5 Nov 2026, 20:01 UTC.