TI-2026-85217 Aliases CVE-2026-55367

Heap exhaustion in h2o through unbounded CONNECT-UDP capsule buffering

LOW 39CWE-770Published 2026-11-04 · Updated 2026-11-05

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-770.

Summary

h2o HTTP server versions before commit 4212ce114506a073505fd389db16ad2ba4e582a0 are affected when proxy.connect-udp is enabled. A remote client can send an incomplete CONNECT-UDP Capsule with an excessively large declared length, and the server keeps buffering received bytes without a per-Capsule limit (CWE-770). An unauthenticated attacker can exhaust server memory by sending such requests, causing loss of availability.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00339 27th percentileScored 2026-11-07

Fix Fixed h2o (h2o): 4212ce114506a073505fd389db16ad2ba4e582a0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
h2oai	h2o	before 4212ce114506a073505fd389db16ad2ba4e582a0	4212ce114506a073505fd389db16ad2ba4e582a0	Patch available	CNA

h2o Vendorh2oai Affected before 4212ce114506a073505fd389db16ad2ba4e582a0 Fixed in 4212ce114506a073505fd389db16ad2ba4e582a0 Patch available CNA

Remediation

Update h2o to commit 4212ce114506a073505fd389db16ad2ba4e582a0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Fix · CNA h2o (h2o) Fixed in 4212ce114506a073505fd389db16ad2ba4e582a0

Timeline

2026-11-04 Threatist record created from CVE-2026-55367
2026-11-05 CISA SSVC decision points changed
2026-11-05 Priority changed: MEDIUM → LOW

References

Other 3

TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences