CVE catalog

CVE-2026-44452

Severity: Medium · CVSS 5.9
Published: Jul 16, 2026, 11:16:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.41% · Oct 25, 2026

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	h2o	bookworm	`2.2.5+dfsg2-7`	vulnerable
Cpe	h2o	Not reported	Not reported	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2+esm1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-7`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu2`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu3`	vulnerable
Ubuntu	dnsdist	pro	`1.8.0-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-3`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2build1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2build2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2ubuntu0.1~esm1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	h2o	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[bookworm] h2o: Minor issue, DoS; bundled picotls client_hello_decode_server_name() accepts a zero-length SNI hostname, and on_client_hello_ptls() then calls ptls_set_server_name() which strlen()s the non-terminated ClientHello buffer

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[h2o]Affected
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[h2o-doc]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-dev-common]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-evloop0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-evloop-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12

Observed: Oct 27, 2026, 7:12:53 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]