CVE catalog

CVE-2026-54340

Severity: High · CVSS 7.5
Published: Jul 17, 2026, 12:16:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.49% · Oct 25, 2026

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	h2o	bookworm	`2.2.5+dfsg2-7`	vulnerable
Cpe	h2o	Not reported	Not reported	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2+esm1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-7`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu2`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu3`	vulnerable
Ubuntu	dnsdist	pro	`1.8.0-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-3`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2build1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2build2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2ubuntu0.1~esm1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	h2o	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[bookworm] h2o: Minor issue, DoS; 2.2.5 h2o_hpack_parse_headers() bounds neither the decoded field count nor retained header state, but amplification requires many deliberately stalled HTTP/2 streams

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[h2o]Affected
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[h2o-doc]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-dev-common]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-evloop0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-evloop-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12

Observed: Oct 27, 2026, 7:12:53 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]