Denial of Service Vulnerability in h2o HTTP Server
CVE-2026-44453

7.5HIGH

Key Information:

Vendor

H2o

Status
H2o
Vendor
CVE Published:
16 July 2026

What is CVE-2026-44453?

The h2o HTTP server is susceptible to a Denial of Service attack due to improper memory handling during static file serving. Specifically, when the server builds file paths on the stack using the alloca function, it may attempt to allocate up to approximately 600KB of memory, which exceeds the default pthread stack size of 128KB implemented in musl libc. This allocation can trigger a segmentation fault when the server tries to access the guard page, ultimately leading to server crashes. A fix has been implemented in commit 6b5370d to resolve this vulnerability.

Affected Version(s)

h2o < 6b5370d

References

https://github.com/h2o/h2o/security/advisories/GHSA-rf9v-...
x_refsource_CONFIRM
https://github.com/h2o/h2o/commit/6b5370d9d09fcf83aa7620d...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.