h3 records
6 published records for vendor h3.
Researcher profile
- Entered KEV
- 0 · 0%
- Weaponized
- 0 · 0%
- Pre-auth RCE
- 0
- With a fix record
- 100%
- Median publish → KEV
- No record has entered KEV
Recurring classes
- CWE-706 Use of Incorrectly-Resolved Name or Reference2
- CWE-208 Observable Timing Discrepancy1
- CWE-290 Authentication Bypass by Spoofing1
- CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')1
- CWE-93 Improper Neutralization of CRLF Sequences ('CRLF Injection')1
The weakness classes this vendor ships most often: where to look.
CWEAttack profile
All records
6 records| Action | CVE | Vulnerability | Severity | KEV | EPSS | Published |
|---|---|---|---|---|---|---|
40Plan | CVE-2026-33128No exploit | h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fieldsh3 · h3 · CWE-93 | Critical10.0 | — | 0.7% | Mar 20, 2026 |
39Monitor | CVE-2026-23527No exploit | h3 v1 has Request Smuggling (TE.TE) issueh3 · h3 · CWE-444 | Critical9.8 | — | 0.6% | Jan 15, 2026 |
36Monitor | CVE-2026-33131No exploit | h3 has a middleware bypass with one gadgeth3 · h3 · CWE-290 | Critical9.1 | — | 0.4% | Mar 20, 2026 |
26Monitor | CVE-2026-33732No exploit | srvx is vulnerable to middleware bypass via absolute URI in request lineh3 · srvx · CWE-706 | Medium6.5 | — | 0.4% | Mar 26, 2026 |
23Monitor | CVE-2026-33129No exploit | h3 has an observable timing discrepancy in basic auth utilsh3 · h3 · CWE-208 | Medium5.9 | — | 0.4% | Mar 20, 2026 |
21Monitor | CVE-2026-33490No exploit | h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routesh3 · h3 · CWE-706 | Medium5.3 | — | 0.3% | Mar 26, 2026 |
- CVE-2026-3312840Plan
h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
CriticalCVSS 10.0No exploitEPSS 1%h3 · h3Mar 20, 2026
- CVE-2026-2352739Monitor
h3 v1 has Request Smuggling (TE.TE) issue
CriticalCVSS 9.8No exploitEPSS 1%h3 · h3Jan 15, 2026
- CVE-2026-3313136Monitor
h3 has a middleware bypass with one gadget
CriticalCVSS 9.1No exploitEPSS 0%h3 · h3Mar 20, 2026
- CVE-2026-3373226Monitor
srvx is vulnerable to middleware bypass via absolute URI in request line
MediumCVSS 6.5No exploitEPSS 0%h3 · srvxMar 26, 2026
- CVE-2026-3312923Monitor
h3 has an observable timing discrepancy in basic auth utils
MediumCVSS 5.9No exploitEPSS 0%h3 · h3Mar 20, 2026
- CVE-2026-3349021Monitor
h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes
MediumCVSS 5.3No exploitEPSS 0%h3 · h3Mar 26, 2026