h2o is an HTTP server that supports HTTP/1.x, HTTP/2, and HTTP/3. When a client sends a TLS or QUIC ClientHello containing a zero‑length SNI extension, h2o mistakenly treats the empty hostname as a NULL‑terminated string and attempts to copy it, leading to a heap overrunning the buffer and potentially crashing the server. This behavior results in a denial‑of‑service condition. The weakness is identified as CWE-125 and CWE-170.

The h2o HTTP server from the vendor h2o is affected. All builds prior to the commit 8dc37cb1f6171f7f772667618ea440696fed82c3 are vulnerable; the fix is incorporated in later releases.

The CVSS score of 5.9 indicates medium severity. The EPSS score is <1%, suggesting a low likelihood of exploitation. The vulnerability is not listed in the CISA KEV catalog. Based on the description, it is inferred that the attack vector requires an attacker to send a TLS or QUIC ClientHello with a zero‑length SNI extension, making the exploit remote and straightforward, though the limited exploitation probability reflects the niche nature of the trigger.