h2o vulnerabilities

CVEs per yearBy the year they were published

1. 20221
2. 20233
3. 20245
4. 202613

Newest CVEs

• CVE-2026-55367

  h2o: heap exhaustion using capsules

  h2o · h2o

  High7.5
• CVE-2026-55368

  h2o: buffer overflow when using the %{error}x log directive

  h2o · h2o

  High8.1
• CVE-2026-59993

  Picotls has NULL pointer dereference during handshake, when running as a client

  h2o · picotls

  Medium6.5
• CVE-2026-45271

  picotls has infinite recursion in the minicrypto ASN.1 decoder

  h2o · picotls

  Medium5.5
• CVE-2026-54340

  h2o has HTTP/2 state amplification

  h2o · h2o

  High7.5
• CVE-2026-44453

  h2o is vulnerable to musl libc stack overflow

  h2o · h2o

  High7.5
• CVE-2026-44452

  h2o is vulnerable to heap overrun

  h2o · h2o

  Medium5.9
• CVE-2026-44436

  Quicly is vulnerable to connection state corruption

  h2o · quicly

  High7.5
• CVE-2026-44435

  Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB

  h2o · quicly

  High7.5
• CVE-2026-44434

  Quicly is vulnerable to stateless reset injection

  h2o · quicly

  Medium5.3