h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HH2o
APPH2O2026-05-29 – 2026-06-04 (excl.)
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Related vulnerabilities
CVE-2026-3960CRITICAL9.8PL ✓same product
RCE przez obejście blacklisty JDBC w REST API H2O-3
CVE-2025-6544CRITICAL9.8PL ✓same product
Deserializacja w H2O umożliwia RCE i odczyt plików systemowych
CVE-2024-10553CRITICAL9.8PL ✓same product
RCE poprzez deserializację w REST API h2oai/h2o-3 (JDBC URL)
CVE-2024-45758CRITICAL9.1PL ✓same product
H2O.ai H2O — RCE i odczyt plików przez niekontrolowany JDBC URL
CVE-2023-6016CRITICAL9.8PL ✓same product
RCE w H2O poprzez funkcję importu modelu POJO