CVE-2026-33490

A flaw was found in H3, a minimal HTTP framework. The mount method, responsible for routing requests to sub-applications, incorrectly uses a simple string comparison to check path prefixes. This allows a remote attacker to craft a URL that bypasses the intended path segment boundary. Consequently...