CVE-2026-55367

waiting for further signals

GHSA-q342-qp8v-p44c ↗

no check availablenot proven exploitable

awaiting cvepublic pockev

other:h2o commits up to 7f76f0d

fixed in commits 4212ce1 and above

ETK-2026-2559, permanent identifier

cvss7.5cna vendorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

4h 19msince last run

18mAI analysis

timeline

0 = cve.org, not yet published

trigger signal −38h51mwaiting for further signals−4h19m

−36h

−24h

−12h

description

H2O instances using proxy.connect-udp may retain excessive data for malformed, unfinished CONNECT-UDP Capsule messages. A remote client that can make CONNECT-UDP requests may exhaust memory and interrupt service; deployments without that feature enabled are not described as affected.

mitigation

Upgrade h2o to commits 4212ce1 and above or later.

fixed in commits 4212ce1 and above

check

exploit

automation

–

auth required

EPSS

–

agent run time

18m

cve.org record, t = 0

not published yet

Δ to public poc

–

Δ to kev

–

outcome

No artifact: an exploit or check was attempted but could not be produced at this moment.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-23 08:19Z
ghsa: trigger signal, started the run
https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c

this entry in the feed

GET /api/v1/feed/CVE-2026-55367

{
  "etk_id": "ETK-2026-2559",
  "cve_id": "CVE-2026-55367",
  "display_id": "CVE-2026-55367",
  "ghsa_id": "GHSA-q342-qp8v-p44c",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "H2O CONNECT-UDP buffering denial of service",
  "summary": "H2O instances using `proxy.connect-udp` may retain excessive data for malformed, unfinished CONNECT-UDP Capsule messages. A remote client that can make CONNECT-UDP requests may exhaust memory and interrupt service; deployments without that feature enabled are not described as affected.",
  "mitigation": "Upgrade h2o to commits 4212ce1 and above or later.",
  "vendor": "other",
  "product": "other:h2o",
  "affected": [
    {
      "affected_notes": [
        "commits up to 7f76f0d"
      ],
      "affected_ranges": [],
      "ecosystem": "other",
      "fixed_versions": [
        "commits 4212ce1 and above"
      ],
      "package_name": "h2o",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 17.623860783333335,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-23T08:19:11+00:00",
      "days": -1.618958968101852,
      "is_lower_bound": true,
      "measured_at": "2026-10-24T23:10:29.095183+00:00",
      "url": "https://github.com/h2o/h2o/security/advisories/GHSA-q342-qp8v-p44c"
    }
  }
}

published 2026-10-24 18:39Z
last change 2026-10-24 23:06Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.