CVE-2026-55368

Received Received - Intake

Buffer Overflow in H2O HTTP Server

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: GitHub, Inc.

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-11-04

Last Modified

2026-11-04

Generated

2026-11-05

AI Q&A

2026-11-05

EPSS Evaluated

N/A

NVD

CVE-2026-55368

Affected Vendors & Products

Vendor	Product	Version / Range
h2o	h2o	< 48b7ae12107fd2b118e4641da49599e9aac8edd8

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

H2O is an HTTP server supporting HTTP/1.x, HTTP/2, and HTTP/3. A vulnerability in its access-log formatter could write past the allocated buffer when a specific custom access-log format was used. This occurred with %{error}x, %q for empty query strings, and numeric elements where a temporary NUL reached the buffer's end. A crafted request could crash the server, and a one-byte NUL overwrite beyond a crash may have additional effects.

Detection Guidance

This vulnerability can be detected by checking the h2o server version and configuration. If you are running a version prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, you are likely affected. Inspect your access-log format configuration for custom formats using %{error}x, %q, or numeric elements.

Impact Analysis

This vulnerability could allow an attacker to crash the H2O server by sending a specially crafted request. In some cases, it might also lead to memory corruption, potentially enabling further exploitation such as unauthorized access or data leakage, depending on the server's configuration and environment.

Compliance Impact

This vulnerability could lead to server crashes or potential memory corruption, which may result in unauthorized access or data exposure. Such incidents could violate GDPR's data protection requirements or HIPAA's safeguards for protected health information if exploited.

Mitigation Strategies

Immediately update h2o to the patched commit 48b7ae12107fd2b118e4641da49599e9aac8edd8 or a newer version. Disable or review custom access-log formats to avoid using %{error}x, %q, or numeric elements that may trigger the buffer overflow.

Hi! I’m here to help you understand CVE-2026-55368. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...