Executive brief
h2o is a high-performance web server that supports modern web protocols. A flaw in how the server handles specific HTTP/3 traffic can cause the application to crash, leading to a denial-of-service. This occurs because the server attempts to use more memory than is available on its internal stack, particularly when running on systems using the musl libc library. An attacker can exploit this to disrupt website availability without needing any login credentials.
Technical details
A stack overflow vulnerability exists in h2o's QPACK implementation within lib/http3/qpack.c. When processing QPACK instructions from a peer over HTTP/3, the server may call alloca() to allocate an on-stack buffer of approximately 800 KB. On systems using musl libc, where the default pthread stack size is 128 KB, this allocation exceeds the stack limit and triggers a segmentation fault when the guard page is accessed. This is a remote, unauthenticated denial-of-service (DoS) vulnerability. The issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 by moving large allocations to the heap. As a workaround, users can disable HTTP/3 support.
Affected products
- h2o h2o Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1
Timeline
- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE-2026-55213 published to NVD