CVE-2026-55367
Received Received - Intake

Memory Exhaustion in H2O HTTP Server via CONNECT-UDP Capsule

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-05
AI Q&A
2026-11-05
EPSS Evaluated
N/A
NVD
CVE-2026-55367

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
h2o h2o < 4212ce114506a073505fd389db16ad2ba4e582a0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in H2O affects the CONNECT-UDP Capsule handling. A client can send an incomplete request with an overly large declared length, causing the server to keep buffering data without a limit while waiting for the rest. This leads to excessive memory consumption and potential server unavailability.

Impact Analysis

If you run an H2O server with proxy.connect-udp enabled and accept CONNECT-UDP requests, this flaw could allow attackers to consume all available memory on your server, causing crashes or denial-of-service conditions.

Mitigation Strategies

Update H2O to commit 4212ce114506a073505fd389db16ad2ba4e582a0 or later to fix the vulnerability. Disable proxy.connect-udp if not needed. Monitor server memory usage for unusual spikes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-55367. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...