DEBIAN-CVE-2026-55367: High severity debian/h2o vulnerability

Published Nov 4, 2026

Updated

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

Affected Software

1 affected component

debian/h2o*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade h2o to a version that resolves this vulnerability.
Patch 4212ce114506a073505fd389db16ad2ba4e582a0

Event History

Nov 4, 2026

CVE Published

via OSV·10:18 PM

Data Sourced

via OSV·10:18 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

Deployments are exposed if they enabled proxy.connect-udp and accept CONNECT-UDP requests. Other deployment conditions are not identified in the available data.

What does an attacker need to do to trigger the issue?

An attacker can send an incomplete CONNECT-UDP Capsule that declares an excessively large length. No privileges or user interaction are required according to the supplied severity vector.

What is the impact if exploitation succeeds?

H2O can continue buffering received bytes while waiting for the remainder of the Capsule, without a per-Capsule limit. This can exhaust server memory and cause loss of availability.

What should be done if the affected functionality is not needed?

Disable proxy.connect-udp or stop accepting CONNECT-UDP requests to remove the exposed condition. The issue is fixed by commit 4212ce114506a073505fd389db16ad2ba4e582a0.

DEBIAN-CVE-2026-55367: High severity debian/h2o vulnerability

Affected Software

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

What is the impact if exploitation succeeds?

What should be done if the affected functionality is not needed?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed to this denial-of-service issue?

What does an attacker need to do to trigger the issue?

What is the impact if exploitation succeeds?

What should be done if the affected functionality is not needed?