CVE-2026-55368High· 8.1▾ Twilighth2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was c…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Nov 6.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.
h2o < 48b7ae12107fd2b118e4641da49599e9aac8edd8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-55367High· 7.5h2o: heap exhaustion using capsules
CVE-2023-6569Critical· 9.3External Control of File Name or Path in h2oai/h2o-3
CVE-2024-10553Critical· 9.8H2O Deserialization of Untrusted Data Vulnerability
CVE-2026-8752Medium· 5.3A weakness has been identified in h2oai h2o-3 up to 7402
CVE-2026-8750Medium· 5.3A vulnerability was identified in h2oai h2o-3 up to 7402
CVE-2026-8751High· 7.3A security flaw has been discovered in h2oai h2o-3 up to 7402