h2o: heap exhaustion using capsules
Only affects h2o deployments that enable proxy.connect-udp and accept CONNECT-UDP requests, in commits up to 7f76f0d. Fixed in commits 4212ce1 and above.
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in commits 4212ce1 and above
- Who is exposed
- Specific setups only
Do first: Check whether your setup matches what the bug needs. Deployments that enable proxy.connect-udp and accept CONNECT-UDP requests are affected. Affected versions are commits up to 7f76f0d.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure12/25Specific setups only, reachable over the network without a login
- Reach?/20Reach: unknown (data gap). No tracked technology or package matched
- Severity7.5/10CVSS 7.5
- No patch0/5No signal
What would change the score
- Would score about 70 if added to CISA KEV
- Would score about 65 if CISA's SSVC rates exploitation active
CVE-2026-55367 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 7.5 (high) and affects h2o; fixed in commits 4212ce1 and above.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 20/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Specific setups only
- Fix
- Fixed in commits 4212ce1 and above
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The h2o HTTP server, when its CONNECT-UDP proxy feature (proxy.connect-udp) is enabled, can be made to run out of memory by a remote attacker who can reach it over the network without logging in. The attacker sends an incomplete CONNECT-UDP Capsule that declares an excessively large length, which makes the server keep buffering data without limit and can take the server offline.
Read the original description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.
What to do
Check whether your setup matches what the bug needs.
Deployments that enable proxy.connect-udp and accept CONNECT-UDP requests are affected. Affected versions are commits up to 7f76f0d.Upgrade to a fixed version: commits 4212ce1 and above.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- h2o h2o
Version range not reported
Evidence 3
- Advisory
- Repository
- Repository
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-55367
Is CVE-2026-55367 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
A client can send many incomplete CONNECT-UDP Capsule data fragments, which makes the H2O server hold on to memory until it runs out and service is interrupted. This is a denial of service.Source: github.com
Am I affected, and how do I check?
The bug affects H2O commits up to 7f76f0d, and only where proxy.connect-udp is enabled and CONNECT-UDP requests are accepted. To check, look at the H2O source commit in use and at whether proxy.connect-udp is set in the configuration file.Source: github.com
How do I fix CVE-2026-55367?
Update H2O to commits 4212ce1 or later, which contain the fix. No workaround is listed in the facts.Source: github.com