CVE-2026-54340

⚠️ high

Summary

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

CVSS Score

7.5

High

EPSS Score

0.3

Exploit Probability

Published Date

2026-07-17

First Seen: 2026-07-17

📊 Relative Risk Intelligence

This CVE is Moderate Risk - more severe than 67.7% of all 360,548 vulnerabilities in our database.

#116,281

Above average severity

Severity Percentile

🎯 CISA SSVC Assessment Updated: Jul 17, 2026

🔍 Exploitation Status

None

No known exploits

⚙️ Automatable

YES

Can be exploited automatically

💥 Technical Impact

Partial

Limited system impact

SSVC data provided by CISA

Last Modified 2026-08-05

Source NVD 🔗

CVSS Vector 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CWE IDs (Weakness Types)

CWE-400 CWE-770

📦 Affected Products 1

Vendor	Product	Status	Affected Versions
h2o	h2o	Affected	> 2026-05-29 < 2026-06-04

🔗 References 2

https://github.com/h2o/h2o/commit/9265bdd9a996ed9926...

Patch

https://github.com/h2o/h2o/security/advisories/GHSA-...

Third Party Advisory

🔗 Related CVEs 6

CVE ID	Severity	CVSS	EPSS	Summary	Published
CVE-2026-44452	🔶 medium	5.9	0.3	h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientH...	2026-07-16
CVE-2026-44453	⚠️ high	7.5	0.3	h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Deni...	2026-07-16
CVE-2026-8750	🔶 medium	5.3	0.0	A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file...	2026-05-17
CVE-2026-8751	⚠️ high	7.3	0.0	A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h...	2026-05-17
CVE-2026-8752	🔶 medium	5.3	0.1	A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-c...	2026-05-17
CVE-2026-3960	⛔ critical	9.8	0.3	A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O...	2026-04-23

These CVEs affect the same products