CVE-2026-44453
h2o is vulnerable to musl libc stack overflow
CVSS Score
7.5
EPSS Score
0.0%
EPSS Percentile
0th
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memory allocated using alloca can be as huge as ~600KB, which exceeds the default pthread stack size used by musl libc (128KB). If the amount of memory allocated by alloca exceeds the stack size, the h2o server crashes with a segmentation fault, while it tries to touch the guard page. This issue has been fixed by commit 6b5370d.
| CWE | CWE-789 CWE-770 |
| Vendor | h2o |
| Product | h2o |
| Published | Jul 16, 2026 |
Stay Ahead of the Next One
Get instant alerts for h2o h2o
Be the first to know when new high vulnerabilities affecting h2o h2o are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High
Affected Versions
h2o / h2o
< 6b5370d