CVE-2026-44452

Name of the Vulnerable Software and Affected Versions h2o versions prior to commit 8dc37cb

Description An issue exists when the server receives a ClientHello message over TLS or QUIC containing a zero-length SNI (Server Name Indication) extension. The server incorrectly assumes the hostname is NULL-terminated and reads beyond the zero-length hostname while attempting to copy it. This can lead to a segmentation violation, resulting in a denial-of-service.

Recommendations Update to the version containing commit 8dc37cb.