Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55368— h2o: buffer overflow when using the %{error}x log directive

Quick assessment

Affected
h2o h2o
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

H2O 是一款支持 HTTP/1.x、HTTP/2 和 HTTP/3 的 HTTP 服务器。在提交 48b7ae12107fd2b118e4641da49599e9aac8edd8 之前，当配置了受影响的自定义访问日志格式时，H2O 的访问日志格式化器可能会向日志行缓冲区之外写入数据。该分配错误影响以下情况：%{error}x 格式符、当查询字符串为空时的 %q 格式符，以及其临时终止 NUL 字符触及缓冲区末尾的数值元素。匹配的请求可能导致服务器崩溃，而崩溃后超出缓冲区的一个字节 NUL 覆盖的具体影响尚未明确。

CVSS 8.1 · High

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55368

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
h2o: buffer overflow when using the %{error}x log directive
Source: CVE Program / CVE List V5
Vulnerability Description
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
跨界内存写
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
h2o h2o < 48b7ae12107fd2b118e4641da49599e9aac8edd8 -

II. Public POCs for CVE-2026-55368

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55368

请登录查看更多情报信息。

Other References for CVE-2026-55368 (3)

IV. Related Vulnerabilities

Same product: h2o
Same vendor: h2o
Same weakness: CWE-787