What’s Vulnerable › Vulnerabilities

CVE-2026-54340: h2o has HTTP/2 state amplification

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2026-07-17 · updated 2026-08-05
• Weakness: CWE-400

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

Affected products

• h2oai/h2o-3: from 2026-05-29 before 2026-06-04 — fixed in 2026-06-04

How to fix

Upgrade to a fixed version: h2oai/h2o-3 2026-06-04. Check the vendor advisory for mitigations.

References

• https://github.com/h2o/h2o/commit/9265bdd9a996ed992681055e3996baf3e09d2063
• https://github.com/h2o/h2o/security/advisories/GHSA-qcrr-wrhc-pgq9

Get alerted when CVE-2026-54340 or the next vulnerability affects your stack