CVE-2026-44452: NULL SNI crash causes DoS

CISO Take

A zero-length SNI extension in a TLS or QUIC ClientHello causes the h2o HTTP/1.x/2/3 server to mishandle a hostname copy that assumes NULL-termination, crashing the worker process with a segmentation fault. Note the naming collision: this is the h2o C HTTP server (h2o.github.io), not the unrelated H2O.ai machine learning library that shares the package name "h2o" in most catalogs — this is a generic edge-server availability bug, not a flaw in an ML pipeline or model. Exploitability is limited in practice: attack complexity is high (CVSS AC:H), there is no public exploit, no Nuclei template, and it is not in CISA KEV; EPSS sits at 0.25% (though ranked in the top 84th percentile relative to all scored CVEs). Only patch if you actually run h2o — as a TLS/QUIC terminator it could sit in front of an AI inference gateway or API, in which case an attacker could repeatedly crash the front-end worker to disrupt availability. Upgrade to a build containing commit 8dc37cb or later, and confirm whether h2o is deployed anywhere in your stack before treating this as AI-relevant.

Sources: NVD GitHub Advisory EPSS

What is the risk?

Medium severity (CVSS 5.9), availability-only impact (C:N/I:N/A:H) with no confidentiality or integrity loss. High attack complexity, no authentication or user interaction required, but no evidence of active exploitation, no public PoC, and no scanner coverage — near-term exploitation likelihood is low. Risk is elevated only where h2o is internet-facing and untriaged crash/restart behavior would go unnoticed.

How does the attack unfold?

Entry point

Attacker sends a crafted TLS or QUIC ClientHello with a zero-length SNI extension to a public-facing h2o server.

AML.T0049

Exploitation

h2o copies the zero-length hostname assuming it is NULL-terminated, dereferencing invalid memory.

Impact

The worker process segfaults and crashes, denying service to legitimate traffic — including any AI inference or gateway service behind it — until it restarts.

AML.T0029

Entry point

Attacker sends a crafted TLS or QUIC ClientHello with a zero-length SNI extension to a public-facing h2o server.

AML.T0049

Exploitation

h2o copies the zero-length hostname assuming it is NULL-terminated, dereferencing invalid memory.

Impact

The worker process segfaults and crashes, denying service to legitimate traffic — including any AI inference or gateway service behind it — until it restarts.

AML.T0029

How severe is it?

CVSS 3.1

5.9 / 10

EPSS

0.4%

chance of exploitation in 30 days

Higher than 35% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

No known exploitation

Sophistication

Moderate

What is the attack surface?

AV Network

AC High

PR None

UI None

S Unchanged

C None

I None

A High

What should I do?

1 step

Update h2o to a build that includes commit 8dc37cb (or the release incorporating GHSA-w68q-rqwx-7wvq). There is no practical workaround short of patching, since SNI inspection happens during the TLS/QUIC handshake before a WAF can filter decrypted traffic. Detection: monitor h2o worker process restarts/crash-loop telemetry (systemd, Docker/Kubernetes restart counts, core dumps) for unexplained segfaults; audit your infrastructure inventory to confirm whether h2o is used anywhere as a reverse proxy or edge server, particularly in front of AI inference or agent endpoints.

What does CISA's SSVC say?

Decision Track

Exploitation none

Automatable No

Technical Impact partial

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

DoS API AML.T0029 - Denial of AI Service

Which compliance frameworks are affected?

This CVE is relevant to:

NIST AI RMF

MANAGE-2.3 - AI system availability and resilience monitoring

Frequently Asked Questions

What is CVE-2026-44452?

A zero-length SNI extension in a TLS or QUIC ClientHello causes the h2o HTTP/1.x/2/3 server to mishandle a hostname copy that assumes NULL-termination, crashing the worker process with a segmentation fault. Note the naming collision: this is the h2o C HTTP server (h2o.github.io), not the unrelated H2O.ai machine learning library that shares the package name "h2o" in most catalogs — this is a generic edge-server availability bug, not a flaw in an ML pipeline or model. Exploitability is limited in practice: attack complexity is high (CVSS AC:H), there is no public exploit, no Nuclei template, and it is not in CISA KEV; EPSS sits at 0.25% (though ranked in the top 84th percentile relative to all scored CVEs). Only patch if you actually run h2o — as a TLS/QUIC terminator it could sit in front of an AI inference gateway or API, in which case an attacker could repeatedly crash the front-end worker to disrupt availability. Upgrade to a build containing commit 8dc37cb or later, and confirm whether h2o is deployed anywhere in your stack before treating this as AI-relevant.

Is CVE-2026-44452 actively exploited?

No confirmed active exploitation of CVE-2026-44452 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-44452?

Update h2o to a build that includes commit 8dc37cb (or the release incorporating GHSA-w68q-rqwx-7wvq). There is no practical workaround short of patching, since SNI inspection happens during the TLS/QUIC handshake before a WAF can filter decrypted traffic. Detection: monitor h2o worker process restarts/crash-loop telemetry (systemd, Docker/Kubernetes restart counts, core dumps) for unexplained segfaults; audit your infrastructure inventory to confirm whether h2o is used anywhere as a reverse proxy or edge server, particularly in front of AI inference or agent endpoints.

What systems are affected by CVE-2026-44452?

This vulnerability affects the following AI/ML architecture patterns: model serving.

What is the CVSS score for CVE-2026-44452?

CVE-2026-44452 has a CVSS v3.1 base score of 5.9 (MEDIUM). The EPSS exploitation probability is 0.41%.

What is the AI security impact?

Affected AI Architectures

model serving

MITRE ATLAS Techniques

AML.T0029 Denial of AI Service

Compliance Controls Affected

NIST AI RMF: MANAGE-2.3

What are the technical details?

Original Advisory

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it contains a zero-length SNI extension, the h2o server runs over the zero-length hostname while trying to copy the hostname, assuming that it is NULL-terminated. This is a potential denial-of-service attack vector in sense that it might trigger segmentation violation. This issue has been fixed by commit 8dc37cb.

Exploitation Scenario

An attacker sends a TLS or QUIC ClientHello containing an SNI extension with a zero-length hostname to an internet-facing h2o instance — for example, one terminating TLS in front of a model-serving or inference API gateway. h2o attempts to copy and NULL-terminate the empty hostname string, dereferencing invalid memory and crashing the worker process with a segmentation fault. Repeating the request against the restarted worker sustains a denial of service against whatever service h2o fronts, without requiring authentication or user interaction.

Weaknesses (CWE)

CWE-125 Out-of-bounds Read Primary CWE-170 Improper Null Termination Primary CWE-125 Out-of-bounds Read CWE-170 Improper Null Termination

CWE-125 — Out-of-bounds Read: The product reads data past the end, or before the beginning, of the intended buffer.

[Implementation] Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does. When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue." Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylis
[Architecture and Design] Use a language that provides appropriate memory abstractions.

Source: MITRE CWE corpus.