What is the CVSS score of CVE-2026-54340?

CVE-2026-54340 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.3%.

Which versions of h2o are affected by CVE-2026-54340?

The h2o HTTP server (all versions prior to commit 9265bdd) is vulnerable to remote denial of service attacks that exhaust server memory through crafted HTTP/2 requests, causing service degradation or…

How to fix or mitigate CVE-2026-54340?

Within 24 hours: Audit all production and staging systems to identify h2o deployments and versions in use, then prioritize those on vulnerable versions for remediation planning. Within 7 days: Implement interim compensating controls including strict per-connection rate limiting (max concurrent streams per client), connection timeout enforcement, and header size restrictions to reduce exploitation surface. Monitor vendor advisories and patch repositories daily. Within 30 days: Establish a patch deployment procedure once the vendor releases a fix covering the vulnerability in commit 9265bdd and later versions, and execute deployment to all affected systems.

h2o CVE-2026-54340

HIGH

Uncontrolled Resource Consumption (CWE-400)

2026-07-17 security-advisories@github.com

Denial Of Service H2O

7.5

CVSS 3.1 · Vendor: github

Severity by source

Vendor (github) PRIMARY

7.5 HIGH

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

7.5 HIGH

Remote, unauthenticated, low-complexity HTTP/2 request path (AV:N/AC:L/PR:N/UI:N); memory-exhaustion DoS gives A:H with no confidentiality or integrity impact.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (github).

CVSS VectorVendor: github

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Source Code Evidence Fetched

Jul 17, 2026 - 00:30 vuln.today

Analysis Generated

Jul 17, 2026 - 00:30 vuln.today

CVE Published

Jul 17, 2026 - 00:16 cve.org

HIGH 7.5

DescriptionCVE.org

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

AnalysisAI

Remote denial of service in the h2o HTTP server (all versions prior to commit 9265bdd) allows unauthenticated attackers to exhaust server memory by combining HPACK header-decompression amplification with Slowloris-style HTTP/2 stream stalling. By opening many streams that stall mid-request, an attacker forces the server to retain large volumes of amplified decoded header state, degrading or crashing the service. There is no public exploit identified at time of analysis, and the CVSS 7.5 (A:H only) reflects an availability-only impact with no confidentiality or integrity effect.

Technical ContextAI

The affected component is h2o's HTTP/2 HPACK decoder (lib/http2/hpack.c). HPACK is the header-compression format for HTTP/2, and it is inherently amplifying: a small compressed field section (using Huffman coding and dynamic-table references) can decode into a much larger set of header fields and bytes. This is a classic CWE-400 (Uncontrolled Resource Consumption) issue. The flaw is that decoded header state was bounded only by soft targets (H2O_MAX_HEADERS=100, H2O_MAX_REQLEN) that functions were expected to tolerate exceeding, with no hard ceiling. When multiple HTTP/2 streams are held open (stalled) simultaneously, each retains its amplified decoded header state, and the aggregate memory across stalled streams is unbounded depending on configuration. The fix in commit 9265bdd introduces H2O_HPACK_MAX_HEADERS_HARD_LIMIT (1000), which raises a hard COMPRESSION error and closes the connection when exceeded, and enforces the H2O_MAX_HEADERS soft cap when adding decoded headers so oversized field sections no longer accumulate unbounded state.

RemediationAI

Upstream fix available (PR/commit); a released patched version is not independently confirmed from the provided data - update h2o to a build that includes commit 9265bdd9a996ed992681055e3996baf3e09d2063, which adds the H2O_HPACK_MAX_HEADERS_HARD_LIMIT (1000) hard cap and enforces the H2O_MAX_HEADERS soft limit in the HPACK decoder. Consult GHSA-qcrr-wrhc-pgq9 (https://github.com/h2o/h2o/security/advisories/GHSA-qcrr-wrhc-pgq9) for the authoritative fixed release. Until you can rebuild or upgrade, compensating controls include tightening HTTP/2 limits in the deployment configuration to bound decoded header state - reduce the maximum concurrent streams per connection and cap request header count/size so stalled streams cannot accumulate unbounded state (trade-off: overly aggressive limits may reject legitimate clients sending many or large headers), and enforce short idle/stream timeouts to reap Slowloris-style stalled streams (trade-off: may prematurely close slow but legitimate mobile clients). Fronting h2o with a reverse proxy or WAF that enforces its own HTTP/2 stream and header limits, or per-IP connection rate limiting, further reduces amplification exposure at the cost of added infrastructure and latency.