Not a U.S. government website. NDD is an independent vulnerability database by Volerion and is not affiliated with or endorsed by NIST or NVD.

CVE-2026-55368 Details

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.

Metrics

CVSS 3.x Severity and Vector Strings:

CNA: [email protected]CVSS-B:8.1 HIGHVector:CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.

URL	Source(s)	Tag(s)
https://github.com/h2o/h2o/commit/48b7ae12107fd2b118e4641da49599e9aac8edd8	[email protected]
https://github.com/h2o/h2o/pull/3757	[email protected]
https://github.com/h2o/h2o/security/advisories/GHSA-m998-r5ww-rqjf	[email protected]

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-787	Out-of-bounds Write	[email protected]

Affected Products

No affected product data is available for this CVE.

Change History

1 change record found show changes