VULNERABILITY INTELLIGENCE
CVE-2026-86250
CVSS score7.5 HIGH
EPSS probability0.49%
CISA KEVNot currently listed
Published2026-09-06
Last modified2026-09-18
CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.
Weakness classification
- disclosure@vulncheck.com: CWE-400