Technical impact
h2o builds static file paths on the stack by calling alloca. The allocation can reach approximately 600 KB, which surpasses the default 128 KB pthread stack size used by musl libc. When the allocation exceeds the stack limit, the server touches the guard page and crashes with a segmentation fault, effectively taking the HTTP service offline. This is a stack-based buffer overflow (CWE‑770) that also involves writing beyond the allocated memory (CWE‑789). The result is a denial of service for clients attempting to access static files that trigger the oversized allocation.
Affected Systems
The vulnerability affects installations of the h2o HTTP server running on systems that use musl libc with its default stack size. Any version of h2o released before commit 6b5370d (identified by the new commit hash 6b5370d9d09fcf83aa7620ddf77de1954a192181) is impacted. No specific version numbers are listed, so any pre‑patch build is considered vulnerable when served on musl‑based environments.
Risk and Exploitability
The CVSS score of 7.5 indicates moderate to high severity. The EPSS score of less than 1 % suggests that exploitation attempts are currently uncommon. The vulnerability is not listed in CISA KEV, reducing urgency from an official exploitation standpoint. Based on the description, the likely attack vector is remote: an attacker crafts an HTTP request for a static file whose path causes the server to allocate a large stack buffer via alloca, leading to a crash and denial of service. No authentication requirement is indicated, so the attack is feasible against any publicly reachable instance.
