{"affected":[{"product":"h2o","source":"CNA: GitHub_M","vendor":"h2o","versions":[{"status":"affected","version":"< 48b7ae12107fd2b118e4641da49599e9aac8edd8"}]}],"cveId":"CVE-2026-55368","cwes":["CWE-787"],"description":"h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.1,"severity":"high","source":"CNA: GitHub_M","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793828284613,"publishedAt":1793828284613,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/h2o/h2o/security/advisories/GHSA-m998-r5ww-rqjf"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/h2o/h2o/pull/3757"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/h2o/h2o/commit/48b7ae12107fd2b118e4641da49599e9aac8edd8"}],"remediation":[],"revision":"ebb60cf09fdf92b0cf22c59bdac32cd8fdda58e434cb9f0c02a7260f02d01d36","sources":[{"modifiedAt":1793828284613,"name":"CNA: GitHub_M","retrievedAt":1793830384772,"url":"https://www.cve.org/CVERecord?id=CVE-2026-55368"}],"ssvc":null,"status":"published","title":"h2o: buffer overflow when using the %{error}x log directive","updatedAt":1793830384772}