CVE-2026-55367 · Runtime
NO FIX YET · SEE WHAT TO DO
h2o, an HTTP/1.x, HTTP/2 and HTTP/3 server, buffers incomplete CONNECT-UDP capsules without a per-capsule size limit when a declared length is excessively large. A remote client can exhaust server memory and take the server down.
first public Oct 23, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only deployments that enable proxy.connect-udp and accept CONNECT-UDP requests are exposed. Servers that leave that proxy feature off are not affected by this flaw.
Not affected if default-config
Who cares h2o, http3, self-hosted
proxy.connect-udp is enabled in the h2o configuration file.4212ce114506a073505fd389db16ad2ba4e582a0.4212ce114506a073505fd389db16ad2ba4e582a0; no fixed release version is stated in the sources.h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.