ETK-2026-2556Zero's internal tracking ID, independent of the CVE number.

{
  "etk_id": "ETK-2026-2556",
  "cve_id": null,
  "display_id": "ETK-2026-2556",
  "ghsa_id": "GHSA-48jv-5969-gjg3",
  "euvd_id": null,
  "status": "published",
  "anchor_state": "awaiting_cve",
  "title": "Cache-Digest memory exhaustion in H2O HTTP/2",
  "summary": "H2O's HTTP/2 Cache-Digest handling can retain excessive decoded data while request streams remain open. An unauthenticated remote client can exhaust server memory and terminate the process. The affected path is enabled by the default HTTP/2 configuration and does not depend on server push.",
  "mitigation": "Upgrade h2o to commits 3d47065 and above or later.",
  "vendor": "other",
  "product": "other:h2o",
  "affected": [
    {
      "affected_notes": [
        "commits up to fd8d69e"
      ],
      "affected_ranges": [],
      "ecosystem": "other",
      "fixed_versions": [
        "commits 3d47065 and above"
      ],
      "package_name": "h2o",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": 7.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 28.70713735,
  "t0_at": null,
  "signals": {
    "trigger_signal": {
      "at": "2026-10-23T08:53:49+00:00",
      "days": -1.5517026226041668,
      "is_lower_bound": true,
      "measured_at": "2026-10-24T22:08:16.270417+00:00",
      "url": "https://github.com/h2o/h2o/security/advisories/GHSA-48jv-5969-gjg3"
    }
  }
}