CVE-2026-55367

The h2o HTTP server is vulnerable to heap exhaustion due to a lack of per-Capsule limits when handling CONNECT-UDP requests. A client can send an incomplete capsule with an excessively large declared length, forcing the server to buffer received bytes indefinitely. This can lead to memory exhaust...

PT-2026-137201

Name of the Vulnerable Software and Affected Versions h2o versions prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0 Description An issue exists where a client can send an incomplete CONNECT-UDP Capsule with an excessively large declared length. This causes the server to continue buffering...