h2o TLS/QUIC Handshake memory corruption

Summaryinfo

A vulnerability was found in h2o. It has been classified as problematic. This impacts an unknown function of the component TLS/QUIC Handshake Handler. The manipulation leads to memory corruption. This vulnerability is referenced as CVE-2026-44452. Remote exploitation of the attack is possible. No exploit is available.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in h2o (unknown version). This issue affects an unknown code block of the component TLS/QUIC Handshake Handler. The manipulation with an unknown input leads to a memory corruption vulnerability. Using CWE to declare the problem leads to CWE-119. The product performs operations on a memory buffer, but it can read from or write to a memory location that is outside of the intended boundary of the buffer. Impacted is availability. The summary by CVE is:

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.

The advisory is shared at github.com. The identification of this vulnerability is CVE-2026-44452 since 05/06/2026. The exploitation is known to be easy. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Neither technical details nor an exploit are publicly available.

The vulnerability scanner Nessus provides a plugin with the ID 327691 (Linux Distros Unpatched Vulnerability : CVE-2026-44452), which helps to determine the existence of the flaw in a target environment.

Applying the patch 8dc37cb is able to eliminate this problem.

The vulnerability is also documented in the vulnerability database at Tenable (327691). If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Name

• h2o

Website

• Product: https://github.com/h2o/h2o/

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion