CVE-2026-54340

highCVSS 7.5covered by 1 sourcefirst seen 2026-07-17

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This issue has been fixed by commit 9265bdd.

⚡ Watch CVE-2026-54340

Get an email if CVE-2026-54340 is added to CISA KEV, gains public exploit code, or a new advisory cites it — max one per day, one-click unsubscribe.

Exploitation outlook

Low exploitation risk0.28% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 20% of all EPSS-scored CVEs.

Advisory coverage (1)

highCVE-2026-54340: h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, t…nvd · 2026-07-17

External references

NVD record for CVE-2026-54340

CVE.org record

Embed the live status

— this badge updates automatically when the KEV or exploit status changes. How to embed it →

[![CVE-2026-54340 status](https://www.csirts.com/badge/CVE-2026-54340)](https://www.csirts.com/cve/CVE-2026-54340)