CVE-2026-44452: h2o is vulnerable to heap overrun
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 8dc37cb
Event History
Frequently Asked Questions
What is the severity of CVE-2026-44452?
CVE-2026-44452 has a medium severity rating of 5.9.
What type of vulnerability is CVE-2026-44452?
CVE-2026-44452 is classified as a heap overrun vulnerability in the h2o HTTP server.
How do I fix CVE-2026-44452?
To fix CVE-2026-44452, update h2o to a version after commit 8dc37cb.
What does CVE-2026-44452 affect?
CVE-2026-44452 affects the h2o HTTP server which supports HTTP/1.x, HTTP/2, and HTTP/3.
What can happen if CVE-2026-44452 is exploited?
Exploitation of CVE-2026-44452 may lead to application crashes due to a heap overrun.