Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
Published: 2026-07-10
Score: 7.5 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A flaw in the handling of QPACK instructions over HTTP/3 causes the h2o server to allocate an on‑stack buffer that can reach around 800 KB. When this buffer size exceeds the default pthread stack size in musl libc, the server crashes with a segmentation fault after hitting the guard page. The crash results in a denial of service as the h2o process terminates.

Affected Systems

The vulnerability affects the h2o HTTP server in all releases before the commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1. The known affected product is h2o:h2o; no specific version range is provided, so any pre‑fix commit installation is vulnerable.

Risk and Exploitability

The issue carries a CVSS score of 7.5, indicating a medium to high severity. The EPSS score indicates a low probability of exploitation. It is not listed in the CISA KEV catalog, implying no confirmed widespread outbreak. An attacker can exploit this by sending a carefully crafted QPACK stream over HTTP/3 to trigger the oversized allocation and cause the server to crash. The attack requires network access to the vulnerable h2o instance and an ability to send HTTP/3 traffic.

Generated by OpenCVE AI on July 29, 2026 at 10:03 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Upgrade h2o to a build that includes commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 or later, which replaces the alloca allocation with a safe size.
  • If upgrading immediately is not possible, increase the thread stack size for the h2o process when using musl libc or configure musl to raise the default stack limit for that user.
  • Alternatively, disable support for HTTP/3 (or QPACK) until the patch is applied to stop the vulnerable code path from executing.

Generated by OpenCVE AI on July 29, 2026 at 10:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 13 Jul 2026 15:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Jul 2026 22:45:00 +0000

Type Values Removed Values Added
First Time appeared H2o
H2o h2o
Vendors & Products H2o
H2o h2o

Fri, 10 Jul 2026 21:15:00 +0000

Type Values Removed Values Added
Description h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
Title h2o: musl libc stack overflow (QPACK)
Weaknesses CWE-789
References
Metrics cvssV3_1

{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}

Subscriptions

H2o H2o
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published:

Updated: 2026-07-13T14:14:45.685Z

Reserved: 2026-06-16T16:16:32.627Z

Link: CVE-2026-55213

cve-icon Vulnrichment

Updated: 2026-07-13T14:14:40.577Z

cve-icon NVD

No data.

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-07-29T10:15:06Z

Weaknesses
  • CWE-789

    Memory Allocation with Excessive Size Value