CVE-2026-55368

The h2o HTTP server (supporting HTTP/1.x, HTTP/2, and HTTP/3) is vulnerable to a buffer overflow in its access-log formatter. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8 , a specifically configured custom access-log format could cause the formatter to write past its log-line buffer. ...