CVE-2026-55368

Name of the Vulnerable Software and Affected Versions h2o versions prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8

Description The access-log formatter in the HTTP server can write past its log-line buffer when a custom access-log format is configured. This occurs due to allocation errors involving %{error}x, %q when the query string is empty, and numeric elements where the temporary terminating NUL reaches the end of the buffer. A specifically crafted request can cause the server to crash, although the impact of a one-byte NUL overwrite beyond a crash has not been determined.

Recommendations Update to the version containing commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.