CVE-2026-44453

Katalog CVE

CVSS 7.5 · High EPSS 0,49%

Kerentanan Allocation of Resources Without Limits or Throttling pada h2o. Skor CVSS 3.1 7.5 (High) menurut github.com.

Deskripsi (NVD)

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca under certain conditions. When serving static files, h2o builds the file path on stack, by calling alloca. The maximum size of the memory allocated using alloca can be as huge as ~600KB, which exceeds the default pthread stack size used by musl libc (128KB). If the amount of memory allocated by alloca exceeds the stack size, the h2o server crashes with a segmentation fault, while it tries to touch the guard page. This issue has been fixed by commit 6b5370d.

Rincian

Terbit di NVD

16 Juli 2026

Terakhir diubah

6 Agustus 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber github.com
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-770: Allocation of Resources Without Limits or Throttling
CWE-789: Memory Allocation with Excessive Size Value

EPSS (30 hari)

0,49% peluang dieksploitasi; lebih tinggi dari 40,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/h2o/h2o/security/advisories/GHSA-rf9v-m59p-mq84 advisory vendor
• https://github.com/h2o/h2o/commit/6b5370d9d09fcf83aa7620ddf77de1954a192181 patch