Denial of Service Vulnerability in H2O HTTP Server's Quicly Implementation

CVE-2026-44433

What is CVE-2026-44433?

The Quicly implementation of the IETF QUIC protocol in the H2O HTTP server is subject to a vulnerability that allows an adversarial entity to exploit how stream frames are processed. Specifically, an attacker could send a STREAM frame containing a single byte at the maximum allowed offset. This action could cause the application to allocate an excessive amount of memory, potentially leading to memory exhaustion and thus a Denial of Service (DoS). The default settings of the H2O HTTP server compound this issue by significantly increasing memory usage per connection. This vulnerability has been resolved in a recent commit.

References