h2o HTTP Server
CVE-2026-44452
MEDIUM
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
AV:N for network-delivered TLS/QUIC handshake; AC:H because zero-length SNI requires non-standard packet crafting; PR:N and UI:N as pre-auth with no interaction; A:H for process crash; C:N and I:N per description and CVSS impact.
Primary rating from Vendor (github).
CVSS VectorVendor: github
Lifecycle Timeline
1DescriptionCVE.org
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.
AnalysisAI
Denial-of-service via malformed TLS/QUIC ClientHello in h2o HTTP server allows remote unauthenticated attackers to crash the server process by sending a zero-length SNI extension. The hostname-copy routine assumes NULL-termination on the empty SNI buffer (CWE-125 out-of-bounds read), reading beyond the allocation boundary and triggering a segmentation fault. No public exploit or active exploitation (CISA KEV) has been identified; the fix is available as an upstream commit but no confirmed tagged release exists at time of analysis.
Technical ContextAI
h2o is an open-source C-based HTTP server supporting HTTP/1.x, HTTP/2, and HTTP/3 (via QUIC). The vulnerability exists in the TLS/QUIC ClientHello handshake processing path, specifically in Server Name Indication (SNI) parsing. SNI (RFC 6066) is a TLS extension that allows clients to declare the target hostname before certificate selection. The root cause, CWE-125 (Out-of-bounds Read), arises because the server's hostname-copy routine treats the SNI value as a NULL-terminated C string; when the extension is present but carries a zero-length value, the routine reads past the end of the empty buffer searching for a terminator. Because h2o supports both TLS over TCP and QUIC over UDP (HTTP/3), both protocol stacks share this ClientHello processing code path, widening the attack surface to any TLS or QUIC listener. The metadata tags include 'Buffer Overflow' and 'Information Disclosure,' but the CWE (125) and description point to an out-of-bounds read rather than a write - a potential discrepancy worth verifying against the vendor advisory, since an OOB read could theoretically expose adjacent memory before crashing.
RemediationAI
The upstream fix is commit 8dc37cb1e6171f7f772667618ea440696fed82c3, available at https://github.com/h2o/h2o/commit/8dc37cb1e6171f7f772667618ea440696fed82c3. No tagged stable release incorporating this commit has been independently confirmed at time of analysis; operators should build h2o from source at or after this commit and monitor the project release page for a versioned release. As a compensating control, deploying a TLS-terminating reverse proxy (e.g., nginx or HAProxy) in front of h2o to validate and strip malformed SNI extensions before forwarding connections reduces direct exposure, at the cost of added architectural complexity and a potential single point of failure. Restricting TLS/QUIC listener access to trusted IP ranges via firewall rules limits the attack surface for non-public deployments, though it does not eliminate risk for publicly accessible services. Refer to the official advisory at https://github.com/h2o/h2o/security/advisories/GHSA-w68q-rqwx-7wvq for maintainer-confirmed guidance.
Denial of service against HTTP/2 server implementations allows remote unauthenticated attackers to exhaust server resour
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitra
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system
An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import f
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file r
In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target s
External Control of File Name or Path in h2oai/h2o-3. Rated high severity (CVSS 8.2), this vulnerability is remotely exp
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cau
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) att
A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack.
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of s
In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` p
Same weakness CWE-125 – Out-of-bounds Read
View allSame technique Buffer Overflow
View allShare
External POC / Exploit Code
Leaving vuln.today