Advisories · Technology

h2o picotls.

Every CVE that names h2o picotls among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-59993 CVE record

CVSS 6.5 Medium

Picotls has NULL pointer dereference during handshake, when running as a client
- h2o picotls
- Memory corruption
Not analysed yet 30 Oct 2026
CVE-2026-45271 CVE record

CVSS 5.5 Medium

picotls has infinite recursion in the minicrypto ASN.1 decoder
- h2o picotls
- Denial of service
Not analysed yet 21 Aug 2026
CVE-2024-45402 CVE record

CVSS 8.6 High

Picotls double free
- h2o picotls
- Memory corruption
Not analysed yet 11 Oct 2024