CVE catalog

CVE-2026-55213

Severity: High · CVSS 7.5
Published: Jul 10, 2026, 9:16:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.49% · Oct 25, 2026

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	h2o	bookworm	`2.2.5+dfsg2-7`	vulnerable
Cpe	h2o	Not reported	Not reported	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu1`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2`	vulnerable
Ubuntu	h2o	pro	`2.2.5+dfsg2-6.1ubuntu2+esm1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-7`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu1`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu2`	vulnerable
Ubuntu	h2o	24.04	`2.2.5+dfsg2-8.1ubuntu3`	vulnerable
Ubuntu	dnsdist	pro	`1.8.0-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.2-3`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2build1`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2build2`	vulnerable
Ubuntu	dnsdist	pro	`1.8.3-2ubuntu0.1~esm1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	h2o	source	bookworm	`(unfixed)`	not yet assigned	Not reported	Not reported

Notes

[bookworm] h2o: Minor issue, DoS

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[h2o]Affected
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[h2o-doc]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-dev-common]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · all · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-evloop0.13]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
[libh2o-evloop-dev]Affected
Source package: [h2o]
Details (2)
- 2.2.5+dfsg2-7 · amd64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12
- 2.2.5+dfsg2-7 · arm64 · bookworm
  Affected
  nvd · h2o · debian · bookworm; nvd · h2o · debian · 12

Observed: Oct 27, 2026, 7:13:07 AM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database]