---
id: "CVE-2026-55367"
kind: "vulnerability"
aliases: ["CVE-2026-55367"]
title: "h2o: unbounded buffering of CONNECT-UDP capsules can exhaust server memory"
severity: "high"
cvss: 7.5
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["h2o", "http3", "runtime", "self-hosted"]
not_affected_if: ["default-config"]
published_at: "2026-11-04T22:18:06+00:00"
first_seen_at: "2026-11-04T23:08:49+00:00"
updated_at: "2026-11-04T23:09:51+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-55367", "first_seen_at": "2026-11-04T23:08:49+00:00"}]
exploit_sources: []
---

# h2o: unbounded buffering of CONNECT-UDP capsules can exhaust server memory

h2o, an HTTP/1.x, HTTP/2 and HTTP/3 server, buffers incomplete CONNECT-UDP capsules without a per-capsule size limit when a declared length is excessively large. A remote client can exhaust server memory and take the server down.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether `proxy.connect-udp` is enabled in the h2o configuration file.
- Check the h2o version or commit in use against commit `4212ce114506a073505fd389db16ad2ba4e582a0`.

## Fix

- Apply the patch in commit `4212ce114506a073505fd389db16ad2ba4e582a0`; no fixed release version is stated in the sources.

## Timeline

- 2026-11-04T23:08:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-55367

## Documents

- [advisory] Vendor advisory: github.com https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c
- [fix] Patch: github.com https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0

## From the sources

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_