CVE-2026-55367: H2O unbounded CONNECT-UDP capsule

CISO Take

H2O, the HTTP server (tracked here under the h2o package), buffers incomplete CONNECT-UDP capsules without a per-capsule size limit, so a single unauthenticated client can declare a huge capsule length and exhaust server memory. This is a network-reachable, low-complexity availability bug (CVSS 7.5) with no confidentiality or integrity impact, and only deployments that explicitly enable proxy.connect-udp and accept CONNECT-UDP requests are exposed. There is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing, so exploitation is not currently observed, though the trivial attack path makes opportunistic abuse plausible once the advisory spreads. Its relevance to AI is indirect: it matters only if H2O fronts model-serving or inference endpoints. Upgrade to a build that includes commit 4212ce114506a073505fd389db16ad2ba4e582a0, or disable proxy.connect-udp until you can patch.

Sources:NVDGitHub AdvisoryATLAS

What is the risk?

Medium-to-high for exposed H2O instances with proxy.connect-udp enabled, and low for everything else. Exploitation needs no authentication or user interaction and has low complexity. Impact is limited to availability (memory exhaustion). There is no known exploitation, EPSS data is unavailable, and the package risk score is 0/100. AI relevance is peripheral: the exposure comes from H2O acting as a reverse proxy or edge server in front of AI/ML services, not from the AI components themselves.

How does the attack unfold?

Initial Access

Attacker locates an internet-facing H2O server with proxy.connect-udp enabled.

AML.T0049

Exploitation

Attacker sends an incomplete CONNECT-UDP capsule with an excessively large declared length, so H2O buffers bytes without a limit.

Resource Exhaustion

Parallel connections drive H2O memory usage up until the process is OOM-killed or unresponsive.

Impact

Services proxied by H2O, including AI inference endpoints, become unavailable.

AML.T0029

Initial Access

Attacker locates an internet-facing H2O server with proxy.connect-udp enabled.

AML.T0049

Exploitation

Attacker sends an incomplete CONNECT-UDP capsule with an excessively large declared length, so H2O buffers bytes without a limit.

Resource Exhaustion

Parallel connections drive H2O memory usage up until the process is OOM-killed or unresponsive.

Impact

Services proxied by H2O, including AI inference endpoints, become unavailable.

AML.T0029

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
H2O	pip	—	No patch
7.5KOpenSSF 5.727 dependentsPushed 13d ago7% patched~0d to patchFull package profile →

Do you use H2O? You're affected.

How severe is it?

CVSS 3.1

7.5 / 10

EPSS

N/A

Exploitation Status

No known exploitation

Sophistication

Trivial

What is the attack surface?

AVNetwork

ACLow

PRNone

UINone

SUnchanged

CNone

INone

AHigh

What should I do?

1 step

1) Update H2O to a build containing commit 4212ce114506a073505fd389db16ad2ba4e582a0 (see PR #3754 and advisory GHSA-q342-qp8v-p44c). 2) If you cannot patch immediately, disable the proxy.connect-udp directive or restrict it to trusted clients through network ACLs. 3) Set container or cgroup memory limits and OOM-restart policies for H2O processes. 4) Monitor for abnormal memory growth in H2O workers and for long-lived CONNECT-UDP sessions that send incomplete capsules. 5) Put rate limits and connection limits in front of the proxy. 6) Inventory whether any AI/ML gateways rely on H2O.

How is it classified?

DoSFrameworkInferenceAML.T0029- Denial of AI Service AML.T0049- Exploit Public-Facing Application

Which compliance frameworks are affected?

This CVE is relevant to:

EU AI Act

Art. 15-Accuracy, robustness and cybersecurity

ISO 42001

A.6.2.6-AI system operation and monitoring

NIST AI RMF

MANAGE 2.3-Respond to previously unknown risks

Frequently Asked Questions

What is CVE-2026-55367?

H2O, the HTTP server (tracked here under the h2o package), buffers incomplete CONNECT-UDP capsules without a per-capsule size limit, so a single unauthenticated client can declare a huge capsule length and exhaust server memory. This is a network-reachable, low-complexity availability bug (CVSS 7.5) with no confidentiality or integrity impact, and only deployments that explicitly enable proxy.connect-udp and accept CONNECT-UDP requests are exposed. There is no EPSS score, no public exploit, no Nuclei template and no CISA KEV listing, so exploitation is not currently observed, though the trivial attack path makes opportunistic abuse plausible once the advisory spreads. Its relevance to AI is indirect: it matters only if H2O fronts model-serving or inference endpoints. Upgrade to a build that includes commit 4212ce114506a073505fd389db16ad2ba4e582a0, or disable proxy.connect-udp until you can patch.

Is CVE-2026-55367 actively exploited?

No confirmed active exploitation of CVE-2026-55367 has been reported, but organizations should still patch proactively.

How to fix CVE-2026-55367?

1) Update H2O to a build containing commit 4212ce114506a073505fd389db16ad2ba4e582a0 (see PR #3754 and advisory GHSA-q342-qp8v-p44c). 2) If you cannot patch immediately, disable the proxy.connect-udp directive or restrict it to trusted clients through network ACLs. 3) Set container or cgroup memory limits and OOM-restart policies for H2O processes. 4) Monitor for abnormal memory growth in H2O workers and for long-lived CONNECT-UDP sessions that send incomplete capsules. 5) Put rate limits and connection limits in front of the proxy. 6) Inventory whether any AI/ML gateways rely on H2O.

What systems are affected by CVE-2026-55367?

This vulnerability affects the following AI/ML architecture patterns: model serving, inference gateways, reverse proxies for ML services.

What is the CVSS score for CVE-2026-55367?

CVE-2026-55367 has a CVSS v3.1 base score of 7.5 (HIGH).

What is the AI security impact?

Affected AI Architectures

model servinginference gatewaysreverse proxies for ML services

MITRE ATLAS Techniques

AML.T0029Denial of AI Service

AML.T0049Exploit Public-Facing Application

Compliance Controls Affected

EU AI Act: Art. 15

ISO 42001: A.6.2.6

NIST AI RMF: MANAGE 2.3

What are the technical details?

Original Advisory

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 4212ce114506a073505fd389db16ad2ba4e582a0, a client could send an incomplete CONNECT-UDP Capsule with an excessively large declared length, causing H2O to keep buffering received bytes without a per-Capsule limit while waiting for the remainder. Deployments that enabled proxy.connect-udp and accepted CONNECT-UDP requests could exhaust server memory and lose availability. This vulnerability is fixed with commit 4212ce114506a073505fd389db16ad2ba4e582a0.

Exploitation Scenario

An attacker finds an internet-facing H2O instance that has proxy.connect-udp enabled and fronts an internal model-inference gateway. They open a CONNECT-UDP request and send a capsule header declaring a very large length, followed by a trickle of data and no completion. H2O keeps buffering the bytes. The attacker opens many such connections in parallel, memory is exhausted, the process is killed, and the inference endpoints behind it become unavailable.

Weaknesses (CWE)

CWE-770Allocation of Resources Without Limits or ThrottlingPrimary CWE-770Allocation of Resources Without Limits or Throttling

CWE-770 — Allocation of Resources Without Limits or Throttling: The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

[Requirements] Clearly specify the minimum and maximum expectations for capabilities, and dictate which behaviors are acceptable when resource allocation reaches limits.
[Architecture and Design] Limit the amount of resources that are accessible to unprivileged users. Set per-user limits for resources. Allow the system administrator to define these limits. Be careful to avoid CWE-410.

Source: MITRE CWE corpus.