CVE-2026-55213: h2o: musl libc stack overflow (QPACK)
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1, when h2o processes a QPACK instruction sent from the peer over HTTP/3, lib/http3/qpack.c might allocate an on-stack buffer as large as approximately 800 KB by calling alloca, which exceeds the default pthread stack size used by musl libc and causes the h2o server to crash with a segmentation fault while touching the guard page. This issue is fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h2oto a version that resolves this vulnerability.Patch edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1
Event History
Frequently Asked Questions
What is the severity of CVE-2026-55213?
The severity of CVE-2026-55213 is rated as high with a score of 7.5.
How do I fix CVE-2026-55213?
To mitigate CVE-2026-55213, update to the version of h2o that includes the fix from commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1.
What exploitation risk does CVE-2026-55213 pose?
CVE-2026-55213 poses a risk of stack overflow which could lead to denial of service.
Which software is affected by CVE-2026-55213?
CVE-2026-55213 affects the h2o HTTP server software.
When was CVE-2026-55213 published?
CVE-2026-55213 was published on July 10, 2026.