Executive brief
h2o is a high-performance HTTP server used to deliver web content. A vulnerability in how the server handles file paths when serving static files can cause the application to crash. This results in a denial-of-service, making the website or web service unavailable to users.
Technical details
A Denial of Service (DoS) vulnerability exists in h2o due to improper memory management in the static file handler (lib/handler/file.c). The server uses the alloca() function to build file paths on the stack. In certain conditions, the requested allocation can reach ~600KB, which exceeds the default 128KB pthread stack size used by musl libc. When the allocation exceeds the stack limit and touches the guard page, the server triggers a segmentation fault and crashes. The vulnerability is exploitable over the network without authentication. The issue was resolved in commit 6b5370d by migrating the allocation from the stack to a memory pool.
Affected products
- h2o h2o Prior to commit 6b5370d
Timeline
- 2026-05-29: advisory: GitHub Security Advisory published
- 2026-07-16: disclosed: NVD publication date
- 2026-07-16: patched: Fix identified in commit 6b5370d