{"id":"CVE-2026-55367","kind":"vulnerability","aliases":["CVE-2026-55367"],"related":[],"title":"h2o: unbounded buffering of CONNECT-UDP capsules can exhaust server memory","description":"h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.","summary":"h2o, an HTTP/1.x, HTTP/2 and HTTP/3 server, buffers incomplete CONNECT-UDP capsules without a per-capsule size limit when a declared length is excessively large. A remote client can exhaust server memory and take the server down.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["h2o","http3","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- Check whether `proxy.connect-udp` is enabled in the h2o configuration file.\n- Check the h2o version or commit in use against commit `4212ce114506a073505fd389db16ad2ba4e582a0`.","fix":"- Apply the patch in commit `4212ce114506a073505fd389db16ad2ba4e582a0`; no fixed release version is stated in the sources.","status":"open","published_at":"2026-11-04T22:18:06+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","triaged_at":"2026-11-04T23:09:51+00:00","updated_at":"2026-11-04T23:09:51+00:00","category":"runtime","confidence":0.7,"triage":{"at":"2026-11-04T23:09:51Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the patch in commit `4212ce114506a073505fd389db16ad2ba4e582a0`; no fixed release version is stated in the sources.","reach":"internet","title":"h2o: unbounded buffering of CONNECT-UDP capsules can exhaust server memory","impact":"medium","summary":"h2o, an HTTP/1.x, HTTP/2 and HTTP/3 server, buffers incomplete CONNECT-UDP capsules without a per-capsule size limit when a declared length is excessively large. A remote client can exhaust server memory and take the server down.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["h2o","self-hosted","http3"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"remote client exhausts server memory, causing denial of service","analyst_note":"Confirm the fixed release version and whether CONNECT-UDP requires authentication, using the NVD entry and the linked vendor advisory on GitHub.","how_to_check":"- Check whether `proxy.connect-udp` is enabled in the h2o configuration file.\n- Check the h2o version or commit in use against commit `4212ce114506a073505fd389db16ad2ba4e582a0`.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Only deployments that enable proxy.connect-udp and accept CONNECT-UDP requests are exposed. Servers that leave that proxy feature off are not affected by this flaw.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000724,"input_tokens":4372,"output_tokens":574,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-55367':15A,18A '4212ce114506a073505fd389db16ad2ba4e582a0':78C,137C 'accept':119C 'avail':130C 'buffer':3A,32B,99C 'byte':101C 'capsul':8A,37B,42B,88C,106C 'caus':95C 'client':54B,80C 'commit':77C,136C 'connect':6A,35B,86C,121C 'connect-udp':5A,34B,85C,120C 'could':81C,124C 'cve':13A,16A 'declar':47B,93C 'deploy':113C 'enabl':115C 'excess':50B,91C 'exhaust':10A,56B,125C 'fix':134C 'h2o':1A,19B,25B,63C,96C 'host':24B 'http':66C 'http/1.x':27B,71C 'http/2':28B,72C 'http/3':30B,74C 'http3':20B 'incomplet':33B,84C 'keep':98C 'larg':51B,92C 'length':48B,94C 'limit':44B,107C 'lose':129C 'memori':12A,58B,127C 'per':41B,105C 'per-capsul':40B,104C 'prior':75C 'proxy.connect':116C 'receiv':100C 'remaind':112C 'remot':53B 'request':123C 'runtim':21B 'self':23B 'self-host':22B 'send':82C 'server':11A,31B,57B,62B,67C,126C 'size':43B 'support':69C 'take':60B 'udp':7A,36B,87C,117C,122C 'unbound':2A 'vulner':132C 'wait':109C 'without':38B,102C","nicknames":[],"mitigations":[],"who_affected":"Only deployments that enable proxy.connect-udp and accept CONNECT-UDP requests are exposed. Servers that leave that proxy feature off are not affected by this flaw.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["h2o","high","http3","runtime","selfhosted"],"campaign_type":null,"first_public_at":"2026-10-23T08:19:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-55367","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-55367","severity":null,"published_at":"2026-11-04T22:18:06+00:00","modified_at":"2026-11-04T22:18:06+00:00","first_seen_at":"2026-11-04T23:08:49+00:00","fetched_at":"2026-11-04T23:08:49+00:00","note":null}],"documents":[{"id":71161,"url":"https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":71162,"url":"https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-23T08:19:11+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"exploit_sources":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}