CVE-2026-55368 in h2o
Summary
by MITRE • 11/05/2026
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 11/05/2026
The h2o HTTP server, which supports modern protocols including HTTP/1.x, HTTP/2, and HTTP/3, contains a critical memory safety vulnerability in its access-log formatting subsystem. This flaw manifests as a buffer overflow that occurs when the server attempts to write log entries based on specific custom format configurations. The root cause lies in improper bounds checking during string manipulation operations within the logging module. Specifically, the formatter fails to correctly account for the space required by certain dynamic elements before writing them into the fixed-size log-line buffer. This oversight allows data to be written beyond the allocated memory boundary of the buffer, resulting in a heap-based or stack-based buffer overflow depending on the internal implementation details of the temporary buffers used during formatting.
The vulnerability is triggered under specific conditions involving particular format specifiers and request characteristics. When an affected custom access-log format includes elements such as %{error}x, which logs HTTP error codes, or %q, which represents the query string, the server becomes susceptible to this flaw if the query string is empty. Additionally, numeric log elements are also vulnerable because their temporary terminating null character can reach the end of the buffer during formatting operations. In these scenarios, the formatter writes a byte past the allocated limit, typically overwriting adjacent memory with a null terminator or other data depending on the specific element being processed. This behavior indicates a failure in validating the remaining space in the destination buffer before performing write operations, which is a classic example of improper input validation leading to out-of-bounds access.
The operational impact of this vulnerability includes the potential for denial of service through server crashes. Since the overflow involves writing past the end of a buffer used by the logging subsystem, it can corrupt adjacent memory structures or overwrite critical control data such as return addresses on the stack or metadata in heap allocations. This corruption typically leads to an immediate crash of the h2o process when the affected code path is executed during request handling. While the primary confirmed effect is a service disruption due to server instability, the one-byte write beyond the buffer boundary could theoretically lead to more severe consequences such as arbitrary code execution if an attacker can precisely control the data written and the memory layout at runtime. However, in this specific instance, the exact impact of that single byte overwrite was not fully established, leaving denial of service as the primary confirmed risk vector for attackers targeting availability.
From a classification perspective, this vulnerability aligns with CWE-120: Buffer Copy without Checking Size of Input (Classic Buffer Overflow) and potentially CWE-787: Out-of-bounds Write. In terms of attack vectors, it relates to ATT&CK technique T1499: Endpoint Denial of Service, as the primary observable effect is the crashing of the server process. The vulnerability exists in versions prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, which introduced fixes for these buffer handling issues. To mitigate this risk, administrators should ensure that h2o is updated to a version containing the aforementioned commit or later. Additionally, until an upgrade can be performed, it is advisable to review custom access-log configurations and avoid using format specifiers like %{error}x or %q when processing requests with empty query strings, although relying solely on configuration changes may not fully eliminate risk if other numeric elements are involved. Regular patching of web server software remains the most effective defense against such memory corruption vulnerabilities.