Answer in brief
CVE-2026-55368 records a High severity (CVSS 8.1) vulnerability in h2o: buffer overflow when using the %{error}x log directive. The current sources do not mark it as known exploited. The current feed maps h2o/h2o (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 8.1. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps h2o/h2o (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| h2o/h2ogeneric | <48b7ae12107fd2b118e4641da49599e9aac8edd8 | 48b7ae12107fd2b118e4641da49599e9aac8edd8 |
Published upstream
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Nov 4, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Nov 4, 2026
h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 48b7ae12107fd2b118e4641da49599e9aac8edd8, H2O's access-log formatter could write past its log-line buffer when an affected custom access-log format was configured. The allocation errors affected %{error}x, %q when the query string was empty, and numeric elements whose temporary terminating NUL reached the end of the buffer. A matching request could crash the server, while the effect of the one-byte NUL overwrite beyond a crash was not established. This vulnerability is fixed with commit 48b7ae12107fd2b118e4641da49599e9aac8edd8.
Quoted source text, attributed separately from HOL analysis.