Read the docs
TI-2026-85218 Aliases CVE-2026-55368

Buffer overflow in h2o access-log formatter

Priority LOW 35CWE-787Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-787 and the CVSS impact.

Summary

h2o HTTP server versions before commit 48b7ae12107fd2b118e4641da49599e9aac8edd8 are affected. A flaw in the access-log formatter (CWE-787) lets it write past its log-line buffer when a custom access-log format uses %{error}x, %q with an empty query string, or numeric elements. A remote attacker can send a matching request to crash the server, and the effect of the one-byte NUL overwrite beyond a crash is not established.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.

Why it matters now

EPSS 0.00321 25th percentileScored 2026-11-07
Fix Fixed h2o (h2o): 48b7ae12107fd2b118e4641da49599e9aac8edd8

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
h2oaih2obefore 48b7ae12107fd2b118e4641da49599e9aac8edd848b7ae12107fd2b118e4641da49599e9aac8edd8Patch availableCNA
  • h2o Vendorh2oai Affected before 48b7ae12107fd2b118e4641da49599e9aac8edd8 Fixed in 48b7ae12107fd2b118e4641da49599e9aac8edd8 Patch available CNA

Remediation

Apply commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, which fixes the issue for h2o. The sources list no fixed version for h2o.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA h2o (h2o) Fixed in 48b7ae12107fd2b118e4641da49599e9aac8edd8

Timeline

  1. 2026-11-04 Threatist record created from CVE-2026-55368
  2. 2026-11-06 Priority changed: MEDIUM → LOW

References

Other 3

  • TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
  • TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
  • TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
  • TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8
See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences