These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
CVE-2026-54340 is an HTTP/2 state amplification issue in h2o, an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. The issue combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams, and depending on the configuration, additional limits are needed to bound decoded header state and prevent attack. This [truncated]
CVE-2026-44453 is a Denial of Service vulnerability in the h2o HTTP server. The vulnerability occurs when the server calls alloca under certain conditions, which can lead to a segmentation fault and crash the server. The issue has been fixed by commit 6b5370d. The vulnerability has a CVSS score of 7.5 and is considered HIGH severity. Users of the h2o HTTP server should be aware of this vulnerability and t [truncated]
CVE-2026-44452 is a denial-of-service vulnerability in h2o HTTP server. The vulnerability occurs when h2o receives a ClientHello message over TLS or QUIC with a zero-length SNI extension, potentially triggering a segmentation violation. Users of h2o HTTP server should be aware of this vulnerability and review official advisories for mitigation guidance.
CVE-2026-44436 is a Denial of Service vulnerability in Quicly, a QUIC protocol implementation. The issue arises from connection state corruption due to inadequate handling of Connection IDs. Quicly's packet decoder accepts Connection IDs up to 255 bytes, but its internal buffers are limited to 20 bytes, leading to potential buffer overruns and assertion failures when processing QUIC version 1 packets with [truncated]
CVE-2026-44435 is a Denial of Service vulnerability in Quicly, an IETF QUIC protocol implementation in the H2O HTTP server. The issue arises when the total number of valid handshake messages received over a CRYPTO stream of a single packet number space exceeds 32KB, causing an assertion failure. This vulnerability was fixed by commit 937d0e9. Users of the H2O HTTP server with the Quicly QUIC protocol impl [truncated]
CVE-2026-44434 is a MEDIUM severity vulnerability in Quicly, a QUIC protocol implementation. It allows an on-path attacker to reset QUIC connections due to lack of packet entry validation. This issue has significant implications for users of Quicly within the H2O HTTP server, as it could allow attackers to disrupt QUIC connections. The vulnerability is caused by Quicly's failure to properly validate packe [truncated]
CVE-2026-44433 is a Denial of Service vulnerability in Quicly, an IETF QUIC protocol implementation. The vulnerability occurs when an adversarial peer sends a STREAM frame carrying just one byte at the largest offset being permitted to obtain additional flow control credit. This could lead to a Denial of Service under certain circumstances. The severity of this vulnerability depends on how the application [truncated]
CVE-2026-55213 is a vulnerability in the h2o HTTP server that causes a crash when processing a QPACK instruction over HTTP/3. The issue arises from the allocation of a large on-stack buffer, exceeding the default pthread stack size, leading to a segmentation fault. This vulnerability was fixed in commit edd7a120bfc4af11ac0cbebce2a43cc1f93f9af1. The vulnerability affects users of the h2o HTTP server, espec [truncated]
CVE-2026-8752 is a medium-severity access control weakness reported in h2oai h2o-3 (up to 7402), in the Rapids setproperty primitive handler at AstSetProperty.exec. The source description says the issue can be triggered remotely and that public exploit material is available, which raises the operational risk for exposed deployments even though the base CVSS score is 5.5.
CVE-2026-8751 describes a remotely reachable flaw in h2oai h2o-3 up to 7402, centered on importBinaryModel in h2o-core/src/main/java/hex/Model.java and the JAR handling path. The issue is described as a manipulation that leads to deserialization, and the CVE notes that exploit code has been made public. For defenders, this is most important anywhere binary model imports are exposed to untrusted input or r [truncated]