CVE-2026-54340 h2o has HTTP/2 state amplification

High 7.5 Published 16 Jul 2026 Updated 17 Jul 2026

Attackers can cause denial of service in h2o HTTP server by exploiting HTTP/2 state amplification via HPACK decompression and stream stalling.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2026-54340?

CVE-2026-54340 is a high-severity denial of service vulnerability in h2o, published on 16 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

Weakness: CWE-770, CWE-400

Which versions are affected by CVE-2026-54340?

It affects 1 product.

Products include H2o H2o.

How do I fix CVE-2026-54340?

No fix has been published for CVE-2026-54340 yet. Limit exposure of the affected software until one is available.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-54340 being exploited?

There is no known exploitation of CVE-2026-54340 in the wild and no public exploit code.

Sources

Also known as DEBIAN-CVE-2026-54340, GHSA-qcrr-wrhc-pgq9, UBUNTU-CVE-2026-54340.