CVE-2026-54340: h2o has HTTP/2 state amplification
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h2oto a version that resolves this vulnerability.Fixed in 9265bdd
Event History
Frequently Asked Questions
What is the severity of CVE-2026-54340?
CVE-2026-54340 has a high severity rating of 7.5.
What is the impact of CVE-2026-54340?
CVE-2026-54340 can lead to denial of service due to HTTP/2 state amplification.
How do I fix CVE-2026-54340?
To fix CVE-2026-54340, update to the latest version of the h2o HTTP server where the issue has been resolved.
Who is affected by CVE-2026-54340?
Anyone using the affected versions of the h2o HTTP server prior to commit 9265bdd is at risk from CVE-2026-54340.
What versions of h2o are vulnerable to CVE-2026-54340?
Versions of h2o prior to the commit 9265bdd are vulnerable to CVE-2026-54340.