CVE-2026-55368 · Runtime
NO FIX YET · SEE WHAT TO DO
H2O's access-log formatter can write past its log-line buffer when a custom access-log format uses %{error}x, %q with an empty query string, or numeric elements. A request that matches the affected format can crash the server, and the sources do not establish any further effect from the one-byte NUL overwrite.
first public Oct 23, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Only servers running H2O with a custom access-log format that includes %{error}x, %q, or numeric elements are affected, since the default format is not described as vulnerable. A matching request can crash the server. Operators using the default log format or no access log can skip it.
Not affected if default-access-log, no-custom-log-format
Who cares h2o, self-hosted
access-log format containing %{error}x, %q, or numeric elements.48b7ae12107fd2b118e4641da49599e9aac8edd8.48b7ae12107fd2b118e4641da49599e9aac8edd8; no fixed release version is stated in the sources.h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.