CVE-2026-54340 Details
Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.
A state amplification vulnerability has been identified in the h2o HTTP server, affecting versions prior to commit 9265bdd. This issue arises from a combination of HPACK decompression amplification and Slowloris-style stream stalling, which can lead to an excessive retention of decoded header state by stalled HTTP/2 streams. Depending on the server's configuration, additional limits may be required to manage the decoded header state and mitigate the risk of such an attack.
Users can update to h2o version 9265bdd or later, where this vulnerability has been fixed.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/h2o/h2o/commit/9265bdd9a996ed992681055e3996baf3e09d2063 | [email protected] | Patch |
| https://github.com/h2o/h2o/security/advisories/GHSA-qcrr-wrhc-pgq9 | [email protected] | Third Party Advisory |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-770 | Allocation of Resources Without Limits or Throttling | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| h2o h2o | >= 2026-05-29, < 2026-06-04 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 5, 2026 | Initial Analysis | [email protected] |
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 17, 2026 | New CVE Received | [email protected] |