Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
🚨 HIGH: CVE-2026-55213 (CVSS 7.5) - h2o HTTP server vulnerable to DoS via QPACK instruction crash in HTTP/3. Excessive stack allocation causes segfault. Update to commit edd7a120 immediately. #CVE #PatchNow https://t.co/E3X6gDPnkH
Post summary
The tweet announces a DoS vulnerability (CVE-2026-55213) in h2o's HTTP/3 implementation and urges users to apply the patch at commit edd7a120 immediately.