Executive brief
h2o is a high-performance HTTP server used to deliver web content over various protocols including HTTP/2 and HTTP/3. A vulnerability has been identified where a specially crafted connection request can cause the server to crash. This could lead to a denial-of-service, disrupting website availability and business operations.
Technical details
An out-of-bounds read and improper null termination vulnerability exists in the h2o HTTP server. When the server receives a ClientHello message over TLS or QUIC that includes a zero-length Server Name Indication (SNI) extension, it attempts to copy the hostname under the incorrect assumption that it is NULL-terminated. This causes the server to read past the buffer, potentially triggering a segmentation violation and resulting in a denial-of-service (DoS). The attack can be initiated remotely over the network without authentication, though it is rated with high attack complexity. The issue is addressed in commit 8dc37cb.
Affected products
- h2o h2o Prior to commit 8dc37cb
Timeline
- 2026-05-29: patched: Fix committed in 8dc37cb
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: CVE published to NVD