Is CVE-2026-55367 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-55367 being exploited in the wild.

How severe is CVE-2026-55367?

High severity, with a CVSS score of 7.5, published 4 November 2026.

Which products and versions are affected?

H2o prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0.

Is there a fix for CVE-2026-55367?

Yes: fixed in commit 4212ce114506a073505fd389db16ad2ba4e582a0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-55367 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-55367?

Check whether you run H2o at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-55367: h2o HTTP server denial of service in CONNECT-UDP parsing

CVE-2026-55367 · Severity: high · CVSS 7.5 · Published 2026-11-04

h2o is an open-source HTTP server supporting HTTP/1.x, HTTP/2, and HTTP/3 protocols. When the CONNECT-UDP proxy feature is enabled, an attacker can send a specially crafted incomplete CONNECT-UDP message with an inflated declared size, causing the server to buffer incoming data indefinitely and exhaust memory, leading to service outages.

Vendors: H2o.

Quick answers

Is CVE-2026-55367 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-55367 being exploited in the wild.
How severe is CVE-2026-55367?: High severity, with a CVSS score of 7.5, published 4 November 2026.
Which products and versions are affected?: H2o prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0.
Is there a fix for CVE-2026-55367?: Yes: fixed in commit 4212ce114506a073505fd389db16ad2ba4e582a0. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-55367 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-55367?: Check whether you run H2o at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: commit 4212ce114506a073505fd389db16ad2ba4e582a0

Technical details

The vulnerability exists in h2o's CONNECT-UDP capsule parsing logic, where the server lacks per-capsule buffering limits when processing incomplete CONNECT-UDP Capsules. An attacker can send a capsule with an excessively large declared length value; the server will continue buffering received bytes without enforcing a size limit, waiting for the remainder to arrive. This unbounded buffering exhausts server memory and causes denial of service on deployments with proxy.connect-udp enabled.

Affected products

h2o h2o prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0

Timeline

2026-11-04: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.