CVE-2026-54340

HighCVSS 7.5/10Last modified Aug 5, 2026

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
h2o	h2o	< 9265bdd

References

https://github.com/h2o/h2o/commit/9265bdd9a996ed992681055e3996baf3e09d2063Patch
https://github.com/h2o/h2o/security/advisories/GHSA-qcrr-wrhc-pgq9Third Party Advisory

Timeline

Published: Jul 17, 2026
Last modified: Aug 5, 2026
NVD status: Analyzed

Related CVEs from 2026

CVE-2026-543417.5Dragonfly is an in-memory data store built for modern application workloads. Prior to 1.39.0, a crafted RESTORE payload triggers an out-of-b CVE-2026-543428.1In epa4all, prior to version 2026-05-20, an attacker on the network path between epa4all and any backend (ePA Aktensystem, Konnektor, IDP, T CVE-2026-543438.7Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.52.1, a remote att CVE-2026-543448.8ToolJet is an open-source low-code platform for building internal tools. Prior to 3.20.180, ToolJet's render preview deployment workflow int CVE-2026-543457.5gopacket provides packet processing capabilities for Go. In version 1.6.0 and earlier, the Diameter AVP decoder computes an AVP data length CVE-2026-543478.7Froxlor is open source server administration software. Prior to 2.3.8, DNS TXT record content accepted by lib/Froxlor/Api/Commands/DomainZon CVE-2026-543487.2Froxlor is open source server administration software. Prior to 2.3.8, the Admins.add and Admins.update endpoints in lib/Froxlor/Api/Command CVE-2026-543499.8Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.CVE-2026-54357.3The deprecated functions ns_printrrf, ns_printrr and fp_nquery in the GNU C Library version 2.2 and newer fail to enforce the caller-supplie CVE-2026-543509.8Budibase is an open-source low-code platform. Prior to 3.39.12, an unauthenticated visitor of any published Budibase app reads every docume CVE-2026-543519.6Budibase is an open-source low-code platform. Prior to 3.39.9, the webhook trigger endpoint in Budibase is publicly accessible and passes th CVE-2026-543529.6Budibase is an open-source low-code platform. Prior to 3.39.9, `POST /api/pwa/process-zip` at packages/server/src/api/routes/static.ts:24 ac