# CVE-2026-55213: h2o stack overflow in QPACK HTTP/3 processing

Source: https://junglewise.ai/threats/cve-2026-55213-h2o-stack-overflow-in-qpack-http-3-processing  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-10. Updated: 2026-07-10  
License: CC BY 4.0 with a link back

CVE-2026-55213 · Severity: high · CVSS 7.5 · Published 2026-07-10

h2o is a high-performance web server that supports modern web protocols. A flaw in how the server handles specific HTTP/3 traffic can cause the application to crash, leading to a denial-of-service. This occurs because the server attempts to use more memory than is available on its internal stack, particularly when running on systems using the musl libc library. An attacker can exploit this to disrupt website availability without needing any login credentials.

## Quick answers

**Is CVE-2026-55213 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-55213 being exploited in the wild.

**How severe is CVE-2026-55213?** High severity, with a CVSS score of 7.5, published 10 July 2026.

**Which products and versions are affected?** h2o h2o Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.

**Is there a fix for CVE-2026-55213?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-55213 attacked?** It is attacked over the network, in a hosted service.

**Am I affected by CVE-2026-55213?** Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stack overflow vulnerability exists in h2o's QPACK implementation within lib/http3/qpack.c. When processing QPACK instructions from a peer over HTTP/3, the server may call alloca() to allocate an on-stack buffer of approximately 800 KB. On systems using musl libc, where the default pthread stack size is 128 KB, this allocation exceeds the stack limit and triggers a segmentation fault when the guard page is accessed. This is a remote, unauthenticated denial-of-service (DoS) vulnerability. The issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 by moving large allocations to the heap. As a workaround, users can disable HTTP/3 support.

## Affected products

- h2o h2o Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1

## Timeline

- 2026-06-29: advisory: GitHub Security Advisory published
- 2026-07-10: disclosed: CVE-2026-55213 published to NVD

## References

- [https://github.com/h2o/h2o/commit/edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1](https://github.com/h2o/h2o/commit/edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1)
- [https://github.com/h2o/h2o/security/advisories/GHSA-432c-8xmj-frmq](https://github.com/h2o/h2o/security/advisories/GHSA-432c-8xmj-frmq)