FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

h2o -- heap overrun parsing zero-length SNI

Affected packages
		h2o	<	20260609

Details

VuXML ID	fba766f4-ccda-4e1b-8875-ab857c6a6532
Discovery	2026-05-29
Entry	2026-06-11

h2o project reports:

When h2o receives a TLS or QUIC ClientHello containing a zero-length SNI extension, it can overrun the zero-length hostname while copying it. This can trigger a segmentation fault and cause a denial of service.

[source]

References

CVE Name	CVE-2026-44452
URL	https://github.com/h2o/h2o/security/advisories/GHSA-w68q-rqwx-7wvq