CVE-2026-55367: h2o: heap exhaustion using capsules
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h2oto a version that resolves this vulnerability.Patch 4212ce114506a073505fd389db16ad2ba4e582a0
Event History
Frequently Asked Questions
Which deployments are affected?
Deployments are affected if they enabled proxy.connect-udp and accept CONNECT-UDP requests. The issue applies to versions prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0.
What does an attacker need to exploit this issue?
An attacker only needs network access to send a CONNECT-UDP request and an incomplete Capsule declaring an excessively large length. No privileges or user interaction are required.
What happens if the issue is exploited?
H2O can continue buffering received bytes while waiting for the incomplete Capsule remainder, without a per-Capsule limit. This can exhaust server memory and cause loss of availability.
What should be done if patching cannot happen immediately?
Disable proxy.connect-udp or stop accepting CONNECT-UDP requests until the fix can be applied. This removes the affected request path described for the vulnerability.
How can I remediate the issue?
Update H2O to include commit 4212ce114506a073505fd389db16ad2ba4e582a0, which fixes the missing per-Capsule buffering limit.