The vulnerability arises from an interaction between HPACK decompression and HTTP/2 stream stalling. An attacker can send oversized header blocks that are decompressed into large memory structures while keeping the HTTP/2 stream stalled, allowing the server to accumulate decoded header state beyond configured limits and exhausting memory and potentially crashing or slowing the server. The weakness is a lack of bounds on resource usage and an expansion of decoded state beyond acceptable limits.

Affected h2o HTTP server releases prior to commit 9265bdd, the GitHub commit referenced, in versions that enable HTTP/2 without limits on decoded header state.

The CVSS score of 7.5 indicates moderate to high severity. The EPSS score is below 1%, suggesting a low likelihood of exploitation in the general population, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is remote, over an unauthenticated HTTP/2 connection, and requires the ability to craft specific header frames and stall streams. An attacker with network access to the server could repeatedly issue such requests, provoking memory growth until the server becomes unresponsive.