CVE-2024-38063

CVE-2024-38063 - SSP H3 For this setupthe one from the video I've used Windows 22H2 19045 and build 2468. this CVE is not patched until 4780 I've tried this with Qemu/KVM but the network adapter was not coalescing the packets from what i've investigated with tcpdump. The solution was to use...

h3-cli

NodeZero MCP Server The NodeZero MCP Server is now available, enabling you to run and manage a locally hosted MCP Server that brings NodeZero’s Find, Fix, Verify FFV capabilities directly to your development and security workflows. MCP Readme h3-cli: CLI tool for the Horizon3.ai API h3-cli is a...

New QPACK Flaws Can Crash HTTP/3 Servers, Trigger Up to 4,000-Fold Memory Amplification

A remote attacker who has not logged in can crash many HTTP/3 web servers with a single connection, security firm FoxIO disclosed, releasing working proof-of-concept code. By sending a small batch of compressed HTTP headers that expands in memory to a much larger set, the attacker can force the...

CLSA-2026-1792233034 TuxCare security update for h3 (1 CVE)

TuxCare rebuilt h3 to address 1 CVE. Fixed in 1.15.3-tuxcare.3...

PT-2026-126739

TuxCare rebuilt h3 to address 1 CVE. Fixed in 1.15.3-tuxcare.3...

CLSA-2026-1791201400 TuxCare security update for h3 (1 CVE)

TuxCare rebuilt h3 to address 1 CVE. Fixed in 1.15.11-tuxcare.1...

PT-2026-115046

TuxCare rebuilt h3 to address 1 CVE. Fixed in 1.15.11-tuxcare.1...

CLSA-2026-1790707412 TuxCare security update for h3 (2 CVEs)

TuxCare rebuilt h3 to address 2 CVEs. Fixed in 1.15.3-tuxcare.2...

PT-2026-109334

TuxCare rebuilt h3 to address 2 CVEs. Fixed in 1.15.3-tuxcare.2...

CLSA-2026-1790616002 TuxCare security update for h3 (2 CVEs)

TuxCare rebuilt h3 to address 2 CVEs. Fixed in 1.15.3-tuxcare.1...

PT-2026-108603

TuxCare rebuilt h3 to address 2 CVEs. Fixed in 1.15.3-tuxcare.1...

SUSE CVE-2026-86250

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie and deleteChunkedCookie functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an On^2 cleanup loop that hangs the server...

CVE-2026-86205

A flaw was found in h3. This open redirect vulnerability exists in the redirectBack utility, which fails to properly sanitize protocol-relative paths in the Referer header. A remote attacker can craft a specially designed URL that bypasses origin validation, leading to a redirect to an external,...

CVE-2026-86252

A flaw was found in h3. This vulnerability allows a remote attacker to inject arbitrary Server-Sent Events SSE by failing to sanitize carriage return characters in EventStream data and comment fields. Attackers can manipulate event type directives, split single push calls into multiple...

CVE-2026-86253

A flaw was found in h3, an npm package. An unauthenticated remote attacker can exploit this vulnerability by sending crafted requests to endpoints served by the serveStatic function. On Node.js deployments, the event.url.pathname is not properly normalized, allowing percent-encoded dot segments t...

CVE-2026-86251

A flaw was found in h3. A remote attacker could exploit a path traversal vulnerability in the serveStatic utility. This vulnerability arises from a double-decoding flaw, where specially crafted, double-encoded dot sequences in a request path are incorrectly processed. This allows an attacker to...

CVE-2026-86250

A flaw was found in h3. This vulnerability allows a remote attacker to send a specially crafted cookie header with an excessively large chunk count. This action triggers an inefficient cleanup process within the setChunkedCookie and deleteChunkedCookie functions, consuming significant server...

Malicious code in h3-next (npm)

Source: amazon-inspector 41a779cef19955b279051dff59351c5f041b3834e2c9bd972c0b0be096aa767f The package h3-next was found to contain malicious code. --- Credit: OpenSSF source...

SUSE CVE-2026-86205

h3 versions before 2.0.1-rc.18 contain an open redirect vulnerability in the redirectBack utility that fails to sanitize protocol-relative paths in the Referer header pathname. Attackers can craft a same-origin URL with a double-slash path segment that passes origin validation but produces a...

SUSE CVE-2026-86251

h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences e.g. %252e%252e to be decoded to %2e%2e, which survives resolveDotSegments because that function only checks for litera...