h2o CVE-2026-54340

The target must be serving HTTP/2, which is the specific protocol path where HPACK decompression and stream multiplexing exist. Exploitation requires the attacker to (1) send compressed HPACK field sections that amplify into large decoded header state, and (2) hold multiple streams open in a stalled state so that state is retained rather than freed. The description explicitly notes the severity is configuration-dependent: 'depending on the configuration, additional limits are needed to bound decoded header state' - deployments that already impose tight header-count/size and concurrent-stream limits are less exposed, while defaults lacking the new hard cap are vulnerable. Reachability requires no special conditions beyond HTTP/2 exposure - the CVSS vector is AV:N/AC:L/PR:N/UI:N, so it is remote and unauthenticated against affected configurations of h2o that serve HTTP/2. The primary limiting factor is that only availability is affected (no data or code-execution impact) and that a server not offering HTTP/2 is not reachable via this path.

The provided CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, base 7.5) is internally consistent with the description: a network-reachable, low-complexity, unauthenticated attack whose sole impact is availability. This is a genuine, easily reachable DoS against any exposed HTTP/2 endpoint, so exploitability is high, but blast radius is limited to service disruption - no data exposure or code execution. No EPSS score, KEV listing, or SSVC decision data was provided, so exploitation probability cannot be quantified from the input; there is no public exploit identified at time of analysis. Weighing these signals, this is a real but moderate priority: trivial to trigger and network-facing, yet availability-only and dependent on the target actually exposing HTTP/2. One nuance to verify: the description notes that whether additional limits are needed is configuration-dependent ('depending on the configuration, additional limits are needed'), so the practical severity varies with per-deployment header/stream limits rather than being uniform across all installs.

An attacker opens an HTTP/2 connection to an internet-facing h2o server and initiates many concurrent streams, each carrying an HPACK-compressed field section that decompresses into a large volume of header state, then deliberately stalls the streams (Slowloris-style) without completing them. Because each stalled stream retains its amplified decoded header state and no hard limit bounds the total, memory consumption climbs until the server degrades or is exhausted. No authentication or user interaction is required (AV:N/AC:L/PR:N/UI:N); no public exploit is identified at time of analysis.