SEPTEMBER 8, 2026
Live Feed
Back to database
Case File

CVE-2026-54340

HIGH · CVSS 7.5 EPSS 0.28% Public Exploit

Source: NVD + CISA KEV + EPSS · Published 2026-07-17 · Last synced 2026-08-16

CyberRota Analysis

AI-Generated

An amplification vulnerability exists in the h2o HTTP server related to HTTP/2, where HPACK decompression can be exploited in conjunction with Slowloris-style stream stalling, potentially allowing attackers to retain excessive decoded header state. This could lead to resource exhaustion and denial of service, particularly affecting server performance under certain configurations. Organizations using h2o should prioritize applying the fix to mitigate the risk of exploitation.

Public Exploit Signal

A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.

Note: these links are listed for security research and verification purposes only.

CVE
CVE-2026-54340
Severity
HIGH
CVSS
7.5
EPSS
0.28%

Original NVD Description

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

Related CVEs

Other vulnerabilities affecting the same vendor(s)