UBUNTU-CVE-2026-55213
A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes it to allocate an excessively large on-stack buffer (~800 KB) when processing QPACK instructions over HTTP/3. This allocation exceeds the default pthread stack size used by musl libc, leading to a segmentation fault and server crash. The issue has been fixed in the specified commit.
AI Analysis
Technical Summary
The h2o HTTP server versions prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 contain a vulnerability in the HTTP/3 QPACK instruction processing code (lib/http3/qpack.c). Specifically, the server uses alloca to allocate an on-stack buffer of approximately 800 KB, which exceeds the default pthread stack size in musl libc environments. This causes a segmentation fault due to touching the guard page, resulting in a denial of service via server crash. The vulnerability is resolved by the referenced commit.
Potential Impact
This vulnerability results in a denial of service condition by crashing the h2o server when processing malicious or malformed QPACK instructions over HTTP/3. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been identified.
Mitigation Recommendations
A fix is available in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1. Users should upgrade to a version of h2o that includes this commit to remediate the issue. Patch status is confirmed by the vendor commit reference.
UBUNTU-CVE-2026-55213
Description
A vulnerability in the h2o HTTP server prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 causes it to allocate an excessively large on-stack buffer (~800 KB) when processing QPACK instructions over HTTP/3. This allocation exceeds the default pthread stack size used by musl libc, leading to a segmentation fault and server crash. The issue has been fixed in the specified commit.
CVSS v3.1
Score 7.5high
Affected software
pkg:deb/ubuntu/[email protected]+dfsg-1ubuntu0.1~esm2?arch=source&distro=esm-apps/bionicpkg:deb/ubuntu/[email protected]+dfsg2-3ubuntu0.1~esm1?arch=source&distro=esm-apps/focalpkg:deb/ubuntu/[email protected]+dfsg2-6.1ubuntu2+esm1?arch=source&distro=esm-apps/jammypkg:deb/ubuntu/[email protected]+dfsg2-8.1ubuntu3?arch=source&distro=noblepkg:deb/ubuntu/[email protected]~esm1?arch=source&distro=esm-apps/nobleRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The h2o HTTP server versions prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1 contain a vulnerability in the HTTP/3 QPACK instruction processing code (lib/http3/qpack.c). Specifically, the server uses alloca to allocate an on-stack buffer of approximately 800 KB, which exceeds the default pthread stack size in musl libc environments. This causes a segmentation fault due to touching the guard page, resulting in a denial of service via server crash. The vulnerability is resolved by the referenced commit.
Potential Impact
This vulnerability results in a denial of service condition by crashing the h2o server when processing malicious or malformed QPACK instructions over HTTP/3. There is no impact on confidentiality or integrity reported. No known exploits in the wild have been identified.
Mitigation Recommendations
A fix is available in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1. Users should upgrade to a version of h2o that includes this commit to remediate the issue. Patch status is confirmed by the vendor commit reference.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- UBUNTU-CVE-2026-55213
- Osv Schema Version
- 1.7.0
- Aliases
- []
- Ecosystems
- ["Ubuntu:Pro:18.04:LTS","Ubuntu:Pro:20.04:LTS","Ubuntu:Pro:22.04:LTS","Ubuntu:24.04:LTS","Ubuntu:Pro:24.04:LTS"]
- Database Specific Severity
- null
- Cvss Version
- 3.1
Threat ID: 6a58b47868715ace43d97f03
Added to database: 07/16/2026, 10:37:44 UTC
Last enriched: 07/16/2026, 11:52:51 UTC
Last updated: 07/31/2026, 19:22:59 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.