CVE-2026-55367

Name of the Vulnerable Software and Affected Versions h2o versions prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0

Description An issue exists where a client can send an incomplete CONNECT-UDP Capsule with an excessively large declared length. This causes the server to continue buffering received bytes without a per-Capsule limit while waiting for the remaining data. In deployments where proxy.connect-udp is enabled and CONNECT-UDP requests are accepted, this can lead to server memory exhaustion and loss of availability.

Recommendations Update to the version containing commit 4212ce114506a073505fd389db16ad2ba4e582a0. Disable the proxy.connect-udp setting to prevent the processing of CONNECT-UDP requests.