Cpe:2.3:a:h3:h3:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ah3h3/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioSun, 06 Sep 2026 12:45:46 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgDenial of Service Vulnerability in h3 Libraryhttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-86250/Sun, 06 Sep 2026 12:45:46 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2026-86250/The h3 library is vulnerable to a denial of service attack due to improper input validation of cookie chunk counts, allowing an attacker to trigger an O(n²) cleanup loop that hangs the server process.The h3 library (versions prior to 2.0.1-rc.18) contains a security flaw in its cookie handling mechanism. Specifically, the functions setChunkedCookie() and deleteChunkedCookie() fail to validate the chunk count parsed from incoming user-controlled cookie values. An unauthenticated attacker can exploit this by sending a specially crafted HTTP request containing a cookie header with an excessively large chunk count. This input forces the library to execute an O(n²) cleanup loop, which consumes excessive CPU resources and results in a denial of service condition by hanging the server process. This vulnerability is significant for any application relying on the h3 library for HTTP header or cookie management, as it allows remote attackers to disrupt service availability without authentication.

Impact

Successful exploitation results in a complete denial of service for the affected application, as the CPU-intensive cleanup loop blocks the server process from handling further legitimate traffic. This can lead to prolonged service outages for affected web applications.

Recommendation

Prioritized actions for development and security teams:

  • Upgrade the h3 library to version 2.0.1-rc.18 or later across all applications.
  • Audit existing deployments to identify applications using affected versions of h3.
  • Implement request rate limiting or WAF rules to detect and drop requests containing unusually large or malformed cookie headers as a temporary mitigation until patching is completed.
]]>lowadvisorydenial-of-servicevulnerabilityweb-application