CVE-2026-55213

h2o: musl libc stack overflow (QPACK)

Published Jul 10, 2026 CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.

Analysis

Technical impact

A flaw in the handling of QPACK instructions over HTTP/3 causes the h2o server to allocate an on‑stack buffer that can reach around 800 KB. When this buffer size exceeds the default pthread stack size in musl libc, the server crashes with a segmentation fault after hitting the guard page. The crash results in a denial of service as the h2o process terminates.

Affected Systems

The vulnerability affects the h2o HTTP server in all releases before the commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1. The known affected product is h2o:h2o; no specific version range is provided, so any pre‑fix commit installation is vulnerable.

Risk and Exploitability

The issue carries a CVSS score of 7.5, indicating a medium to high severity. The EPSS score indicates a low probability of exploitation. It is not listed in the CISA KEV catalog, implying no confirmed widespread outbreak. An attacker can exploit this by sending a carefully crafted QPACK stream over HTTP/3 to trigger the oversized allocation and cause the server to crash. The attack requires network access to the vulnerable h2o instance and an ability to send HTTP/3 traffic.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

h2o

affected

Version	Status	Constraints
`< edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1`	affected	—

No data.

Vendor Product Versions

H2o

Version	Status	Scheme	Platform
`< edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1`	affected	generic	—

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Upgrade h2o to a build that includes commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 or later, which replaces the alloca allocation with a safe size.
If upgrading immediately is not possible, increase the thread stack size for the h2o process when using musl libc or configure musl to raise the default stack limit for that user.
Alternatively, disable support for HTTP/3 (or QPACK) until the patch is applied to stop the vulnerable code path from executing.

Generated by OpenCVE AI on August 1, 2026 at 12:04 UTC.

Tracking

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: < 1% (0.488% probability within 30 days)

Exploitation none

Automatable yes

Technical Impact partial

References

Link	Providers
https://github.com/h2o/h2o/commit/edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1
https://github.com/h2o/h2o/security/advisories/GHSA-432c-8xmj-frmq

History

Jul 13, 2026 3:30 PM Scoring metrics updated View changes

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Jul 10, 2026 10:45 PM First appearance in the feed. Affected vendors updated View changes

Type	Values Removed	Values Added
First Time appeared		H2o H2o h2o
Vendors & Products		H2o H2o h2o

Jul 10, 2026 9:15 PM Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated View changes

Type	Values Removed	Values Added
Description		h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
Title		h2o: musl libc stack overflow (QPACK)
Weaknesses		CWE-789
References		https://github.com/h2o/h2o/commit/edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 https://github.com/h2o/h2o/security/advisories/GHSA-432c-8xmj-frmq
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}`