CVE-2026-44452 h2o is vulnerable to heap overrun

Medium 5.9 Published 16 Jul 2026 Updated 17 Jul 2026

An attacker can cause a denial of service in the h2o HTTP server by sending a TLS or QUIC ClientHello with a zero-length SNI extension, triggering a heap overrun.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-44452?

CVE-2026-44452 is a medium-severity memory corruption vulnerability in h2o, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.

Weakness: CWE-170, CWE-125

Which versions are affected by CVE-2026-44452?

It affects 1 product.

Products include H2o H2o.

How do I fix CVE-2026-44452?

No fix has been published for CVE-2026-44452 yet. Limit exposure of the affected software until one is available.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-44452 being exploited?

There is no known exploitation of CVE-2026-44452 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-44452, GHSA-w68q-rqwx-7wvq, UBUNTU-CVE-2026-44452.