{"affected":[{"product":"h2o","source":"CNA: GitHub_M","vendor":"h2o","versions":[{"status":"affected","version":"< 4212ce114506a073505fd389db16ad2ba4e582a0"}]}],"cveId":"CVE-2026-55367","cwes":["CWE-770"],"description":"h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.5,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"}],"modifiedAt":1793828381868,"publishedAt":1793828381868,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/h2o/h2o/pull/3754"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/h2o/h2o/commit/4212ce114506a073505fd389db16ad2ba4e582a0"}],"remediation":[],"revision":"2055af16d3c73160f61cebe69e95bb120019e81a2c1942c2e6b9ebfb29fffd64","sources":[{"modifiedAt":1793828381868,"name":"CNA: GitHub_M","retrievedAt":1793830383608,"url":"https://www.cve.org/CVERecord?id=CVE-2026-55367"}],"ssvc":null,"status":"published","title":"h2o: heap exhaustion using capsules","updatedAt":1793830383608}