Memory Allocation Issues in H2O HTTP Server Affecting Custom Access-log Formats

CVE-2026-55368

What is CVE-2026-55368?

H2O HTTP Server experienced a vulnerability where the custom access-log formatter could improperly write past its log-line buffer due to allocation errors. This issue specifically arose when using the %{error}x and %q directives with an empty query string. A specially crafted request might trigger a crash of the server, and while a potential overflow could occur, the implications beyond the crash are not yet fully determined. This issue has been resolved with a subsequent commit.

References