Memory Exhaustion Vulnerability in H2O HTTP Server

CVE-2026-55367

What is CVE-2026-55367?

H2O is an advanced HTTP server that supports multiple protocols including HTTP/1.x, HTTP/2, and HTTP/3. A significant vulnerability was identified where clients could send an incomplete CONNECT-UDP Capsule with an unusually large declared length. This allowed the server to enter a state of excessive memory buffering while waiting for the completion of the Capsule. If proxy.connect-udp was enabled, this could lead to a state where the server exhausted its memory resources, drastically affecting service availability. The issue has been rectified in the latest commit, ensuring better robustness against such attacks.

References