CVE-2026-55213

Name of the Vulnerable Software and Affected Versions h2o versions prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1

Description When processing a QPACK instruction sent from a peer over HTTP/3, the server may allocate an on-stack buffer of approximately 800 KB using the alloca() function in lib/http3/qpack.c. This allocation can exceed the default pthread stack size used by musl libc, leading to a segmentation fault and causing the server to crash when the guard page is touched. A guard page is a memory page used to detect stack overflows.

Recommendations Update to the version containing commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.