CVE-2026-44452: h2o is vulnerable to heap overrun

Vulnerability summary

CVE-2026-44452 is a medium (CVSS 5.9) Out-of-bounds Read vulnerability in h2o. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.5% of scored vulnerabilities.

Timeline

1. 16-07-2026
   PublishedVulnerability first disclosed.
2. 17-07-2026
   Last modifiedVulnerability information updated.

Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.

• CWE-125Out-of-bounds ReadThe product reads data past the end, or before the beginning, of the intended buffer.
• CWE-170Improper Null TerminationThe product does not terminate or incorrectly terminates a string or array with a null character or equivalent terminator.