CVE-2026-86250: falha de alta gravidade em h3js h3
h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.7epss 0.5%
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Produtos afetados
h3js · h3CVEs relacionadas — h3js h3
No mesmo produto, das mais perigosas para as menos.
CVE-2026-23527HIGHh3 v1 has Request Smuggling (TE.TE) issueEPSS 0.6%CVE-2026-86253HIGHh3 before 1.15.6 Path Traversal via Percent-Encoded Dot SegmentsEPSS 0.6%CVE-2026-33128HIGHh3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream FieldsEPSS 0.6%CVE-2026-86251HIGHh3 before 1.15.9 Path Traversal via Double DecodingEPSS 0.4%CVE-2026-33131HIGHh3 has a middleware bypass with one gadgetEPSS 0.4%CVE-2026-86252MEDIUMh3 before 1.15.9 SSE Event Injection via Carriage ReturnEPSS 0.4%