AI Threat AlertCVE-2026-55368: H2O: access-log buffer overflow crashes HTTP server
HIGHCVE-2026-55368 is an out-of-bounds write (CWE-787) in the H2O HTTP server's access-log formatter that triggers only when a custom access-log format uses %{error}x, %q with an empty query string, or numeric elements ending at the buffer boundary. A matching network request can crash the server, and the one-byte NUL overwrite beyond a crash has not been shown to be exploitable. Risk is moderate in practice despite the 8.1 CVSS score: attack complexity is high, the vulnerable log formats are non-default, there is no public exploit or Nuclei template, it is not in CISA KEV, and no EPSS score is available yet. Blast radius for AI workloads is limited to deployments that use H2O as a reverse proxy or front end for model-serving endpoints. Note that this is the H2O HTTP server, not the H2O.ai ML platform, so confirm which product your asset inventory is actually matching. Audit access-log configurations for the affected format specifiers and upgrade to a build that includes commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, or remove those specifiers as an interim workaround.
What is the risk?
Medium in practice, High by CVSS (8.1). The flaw is network-reachable and needs no authentication or user interaction, but it requires a non-default custom access-log format and high attack complexity. The demonstrated impact is a crash (availability loss). Code execution or data compromise is not established, since only a single NUL byte is written past the buffer. There is no known exploitation, no public PoC, and no KEV listing. EPSS is unavailable. Exposure is limited to internet-facing or internal H2O instances with the affected log format directives.
How does the attack unfold?
How severe is it?
What is the attack surface?
What should I do?
1 step1) Upgrade H2O to a build that includes commit 48b7ae12107fd2b118e4641da49599e9aac8edd8 (PR #3757). 2) Until patched, review the access-log format in h2o.conf and remove %{error}x, %q, and numeric elements that could land at the end of the log buffer, or switch to the default format. 3) Run H2O under a supervisor with automatic restart and alerting on repeated worker crashes or segfaults. 4) Put rate limiting or a WAF in front of the server to reduce crash-loop abuse. 5) Detect by monitoring for SIGSEGV/abort events in the h2o process and repeated restarts correlated with specific request patterns. 6) Check asset inventory to confirm whether H2O is deployed in front of AI/ML services.
How is it classified?
Which compliance frameworks are affected?
This CVE is relevant to:
Frequently Asked Questions
What is CVE-2026-55368?
CVE-2026-55368 is an out-of-bounds write (CWE-787) in the H2O HTTP server's access-log formatter that triggers only when a custom access-log format uses %{error}x, %q with an empty query string, or numeric elements ending at the buffer boundary. A matching network request can crash the server, and the one-byte NUL overwrite beyond a crash has not been shown to be exploitable. Risk is moderate in practice despite the 8.1 CVSS score: attack complexity is high, the vulnerable log formats are non-default, there is no public exploit or Nuclei template, it is not in CISA KEV, and no EPSS score is available yet. Blast radius for AI workloads is limited to deployments that use H2O as a reverse proxy or front end for model-serving endpoints. Note that this is the H2O HTTP server, not the H2O.ai ML platform, so confirm which product your asset inventory is actually matching. Audit access-log configurations for the affected format specifiers and upgrade to a build that includes commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, or remove those specifiers as an interim workaround.
Is CVE-2026-55368 actively exploited?
No confirmed active exploitation of CVE-2026-55368 has been reported, but organizations should still patch proactively.
How to fix CVE-2026-55368?
1) Upgrade H2O to a build that includes commit 48b7ae12107fd2b118e4641da49599e9aac8edd8 (PR #3757). 2) Until patched, review the access-log format in h2o.conf and remove %{error}x, %q, and numeric elements that could land at the end of the log buffer, or switch to the default format. 3) Run H2O under a supervisor with automatic restart and alerting on repeated worker crashes or segfaults. 4) Put rate limiting or a WAF in front of the server to reduce crash-loop abuse. 5) Detect by monitoring for SIGSEGV/abort events in the h2o process and repeated restarts correlated with specific request patterns. 6) Check asset inventory to confirm whether H2O is deployed in front of AI/ML services.
What systems are affected by CVE-2026-55368?
This vulnerability affects the following AI/ML architecture patterns: model serving, inference gateways, reverse proxy front ends for ML APIs.
What is the CVSS score for CVE-2026-55368?
CVE-2026-55368 has a CVSS v3.1 base score of 8.1 (HIGH).
What is the AI security impact?
Affected AI Architectures
MITRE ATLAS Techniques
AML.T0029Denial of AI ServiceAML.T0049Exploit Public-Facing ApplicationCompliance Controls Affected
What are the technical details?
Original Advisory
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.
Exploitation Scenario
An attacker identifies an internet-facing H2O instance fronting an internal model-inference API, for example through server banners or HTTP/3 support. Assuming the operator configured a custom access-log format using %q or %{error}x, the attacker sends crafted requests, such as ones with an empty query string or specific error conditions, that make the log formatter write past its buffer. The h2o process crashes. Repeating the requests keeps the proxy in a crash loop, taking the AI-serving endpoints offline. Escalation beyond denial of service is not demonstrated.
Weaknesses (CWE)
CWE-787 — Out-of-bounds Write: The product writes data past the end, or before the beginning, of the intended buffer.
- [Requirements] Use a language that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, many languages that perform their own memory management, such as Java and Perl, are not subject to buffer overflows. Other languages, such as Ada and C#, typically provide overflow protection, but the protection can be disabled by the programmer. Be wary that a language's interface to native code may still be subject to overflows, even if the language itself is theoretically safe.
- [Architecture and Design] Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. Examples include the Safe C String Library (SafeStr) by Messier and Viega [REF-57], and the Strsafe.h library from Microsoft [REF-56]. These libraries provide safer versions of overflow-prone string-handling functions.
Source: MITRE CWE corpus.
CVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HReferences
Timeline
Related Vulnerabilities
CVE-2026-3366010.0TensorFlow: type confusion NPD in tensor conversion
Same attack type: DoSCVE-2023-256689.8TensorFlow: unauthenticated RCE via heap buffer overflow
Same attack type: DoSCVE-2022-235879.8TensorFlow: integer overflow in Grappler enables RCE
Same attack type: DoSCVE-2022-359399.8TensorFlow: ScatterNd OOB write enables RCE/crash
Same attack type: DoSCVE-2022-419009.8TensorFlow: heap OOB RCE in FractionalMaxPool op
Same attack type: DoS