Junglewise Threat Intelligence

CVE-2026-44453: h2o stack overflow in static file handler

CVE-2026-44453 · Severity: high · CVSS 7.5 · Published 2026-07-16

Vendors: H2o.

Executive brief

h2o is a high-performance HTTP server used to deliver web content. A vulnerability in how the server handles file paths when serving static files can cause the application to crash. This results in a denial-of-service, making the website or web service unavailable to users.

Technical details

A Denial of Service (DoS) vulnerability exists in h2o due to improper memory management in the static file handler (lib/handler/file.c). The server uses the alloca() function to build file paths on the stack. In certain conditions, the requested allocation can reach ~600KB, which exceeds the default 128KB pthread stack size used by musl libc. When the allocation exceeds the stack limit and touches the guard page, the server triggers a segmentation fault and crashes. The vulnerability is exploitable over the network without authentication. The issue was resolved in commit 6b5370d by migrating the allocation from the stack to a memory pool.

Affected products

  • h2o h2o Prior to commit 6b5370d

Timeline

  • 2026-05-29: advisory: GitHub Security Advisory published
  • 2026-07-16: disclosed: NVD publication date
  • 2026-07-16: patched: Fix identified in commit 6b5370d

References