H3

H3

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
5.3

CVE-2026-33490

Exploit
  • EPSS 0.04%
  • Veröffentlicht 26.03.2026 17:19:15
  • Zuletzt bearbeitet 31.03.2026 21:00:13

H3 is a minimal H(TTP) framework. In versions 2.0.0-0 through 2.0.1-rc.16, the `mount()` method in h3 uses a simple `startsWith()` check to determine whether incoming requests fall under a mounted sub-application's path prefix. Because this check doe...

9.1

CVE-2026-33131

Exploit
  • EPSS 0.02%
  • Veröffentlicht 20.03.2026 10:16:29
  • Zuletzt bearbeitet 20.03.2026 19:45:14

H3 is a minimal H(TTP) framework. Versions 2.0.0-0 through 2.0.1-rc.14 contain a Host header spoofing vulnerability in the NodeRequestUrl (which extends FastURL) which allows middleware bypass. When event.url, event.url.hostname, or event.url._url is...

5.9

CVE-2026-33129

Exploit
  • EPSS 0.04%
  • Veröffentlicht 20.03.2026 09:41:21
  • Zuletzt bearbeitet 20.03.2026 19:58:02

H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid pass...

10

CVE-2026-33128

Exploit
  • EPSS 0.02%
  • Veröffentlicht 20.03.2026 09:37:07
  • Zuletzt bearbeitet 20.03.2026 20:00:21

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEve...

9.8

CVE-2026-23527

Exploit
  • EPSS 0.03%
  • Veröffentlicht 15.01.2026 19:24:20
  • Zuletzt bearbeitet 13.04.2026 17:16:27

H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly...