CVE-2026-54340: fallo de gravedad alta en h2o
h2o has HTTP/2 state amplification
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
21Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 7.5epss 0.5%
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Productos afectados
h2o · h2oCVEs relacionadas — h2o
En el mismo producto, de las más peligrosas a las menos.
CVE-2021-43848HIGHUnititialized memory access in h2oEPSS 2.7%CVE-2023-30847HIGHH2O vulnerable to read from uninitialized pointer in the reverse proxy handlerEPSS 0.9%CVE-2023-50247LOWh2o QUIC state exhaustion DoSEPSS 0.9%CVE-2024-45403LOWH2O assertion failure when HTTP/3 requests are cancelledEPSS 0.7%CVE-2026-44453HIGHh2o is vulnerable to musl libc stack overflowEPSS 0.5%CVE-2026-55213HIGHh2o: musl libc stack overflow (QPACK)EPSS 0.5%