h2o HTTP Server CVE-2026-44452

Exploitation requires that the h2o server has at least one TLS (HTTPS) or QUIC (HTTP/3) listener active and network-reachable by the attacker; h2o instances serving only plain HTTP without TLS are not affected by this code path. The attacker must craft a non-standard TLS ClientHello containing a zero-length SNI extension value - standard TLS stacks (browsers, curl, OpenSSL) do not produce this by default, which accounts for the High Attack Complexity (AC:H) in the CVSS vector and means opportunistic scanning tools are unlikely to trigger this inadvertently. No authentication, session state, or user interaction is required. Exploitation is further limited to the specific SNI parsing routine; other aspects of h2o's request handling are unaffected.

The CVSS 3.1 score of 5.9 (Medium) with vector AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H captures the key tension: network-accessible and requiring no authentication or user interaction, but with High Attack Complexity - standard TLS client libraries do not emit zero-length SNI, so reliable exploitation requires crafting non-standard handshake packets. Impact is restricted to Availability (A:H, server crash), with no confirmed confidentiality or integrity impact. No EPSS data was provided, and h2o is not listed in CISA KEV, suggesting no known widespread active exploitation. The 'Information Disclosure' tag in the input is inconsistent with the CVSS C:N metric and the description's DoS-only framing; unless the vendor advisory clarifies memory leakage potential, this should be treated as a DoS-only issue. Overall, this is a real but lower-priority vulnerability: meaningful for operators of public-facing h2o TLS/QUIC endpoints who cannot tolerate service crashes, but not an immediate high-urgency patch given the complexity requirement and absence of public exploit code.

A remote attacker crafts a TLS ClientHello packet with an SNI extension whose length field is set to zero and sends it to an h2o server's TLS or QUIC listener. The server's SNI hostname-copy routine reads past the empty buffer looking for a NULL terminator, triggering a segmentation fault that crashes the h2o process. Because the attack targets the initial handshake message over both TCP/TLS and UDP/QUIC, the attacker can reach any h2o deployment with a public TLS or HTTP/3 endpoint; if the process does not auto-restart, repeated sends can sustain a denial of service. No public PoC has been identified at time of analysis.