Vulnerability · Published Nov 4, 2026 · Assigned by GitHub_M

CVE-2026-55367h2o: heap exhaustion using capsules

High 7.5

In plain English

A high-severity resource allocation without limits in h2o from h2o. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.3%top 72.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Debian:12	h2o	no fix listed	DEBIAN-CVE-2026-55367
Ubuntu:24.04:LTS	h2o	no fix listed	UBUNTU-CVE-2026-55367

Affected products (as reported)

Vendor	Product	Versions
h2o	h2o	< 4212ce114506a073505fd389db16ad2ba4e582a0

Weakness: CWE-770 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c x_refsource_CONFIRM
https://github.com/h2o/h2o/pull/3754 x_refsource_MISC
https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0 x_refsource_MISC