Denial-of-Service Vulnerability in H2O HTTP Server

CVE-2026-44452

What is CVE-2026-44452?

The H2O HTTP server is susceptible to a denial-of-service vulnerability when it encounters a zero-length SNI extension in a ClientHello message over TLS or QUIC. This issue arises because the server attempts to handle a zero-length hostname, leading to potential segmentation violations. This vulnerability could allow an attacker to disrupt service by sending specially crafted requests. The problem has been addressed in a commit that ensures safe handling of hostname values.

References