CVE-2026-86250

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86250", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-06T11:35:19.316Z", "datePublished": "2026-09-06T12:00:26.211Z", "dateUpdated": "2026-09-18T17:23:10.520Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-06T12:00:26.211Z"}, "datePublic": "2026-03-21T00:00:00.000Z", "title": "h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie", "descriptions": [{"lang": "en", "value": "h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n\u00b2) cleanup loop that hangs the server process."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Uncontrolled Resource Consumption", "cweId": "CWE-400", "type": "CWE"}]}], "affected": [{"vendor": "h3js", "product": "h3", "defaultStatus": "unaffected", "packageURL": "pkg:npm/h3", "versions": [{"version": "2.0.0-beta.4", "status": "affected", "versionType": "semver", "lessThan": "2.0.1-rc.18"}, {"version": "2.0.1-rc.18", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 8.7, "baseSeverity": "HIGH"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-q5pr-72pq-83v3)"}, {"name": "VulnCheck Advisory: h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie"}], "credits": [{"lang": "en", "value": "offset", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T17:07:52.002310Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T17:23:10.520Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86250", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-18T17:07:52.002310Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-18T17:18:06.665Z"}}], "cna": {"title": "h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie", "credits": [{"lang": "en", "type": "reporter", "value": "offset"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 8.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "h3js", "product": "h3", "versions": [{"status": "affected", "version": "2.0.0-beta.4", "lessThan": "2.0.1-rc.18", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.1-rc.18", "versionType": "semver"}], "packageURL": "pkg:npm/h3", "defaultStatus": "unaffected"}], "datePublic": "2026-03-21T00:00:00.000Z", "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3", "name": "GitHub Security Advisory (GHSA-q5pr-72pq-83v3)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie", "name": "VulnCheck Advisory: h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n\u00b2) cleanup loop that hangs the server process."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-06T12:00:26.211Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86250", "state": "PUBLISHED", "dateUpdated": "2026-09-18T17:23:10.520Z", "dateReserved": "2026-09-06T11:35:19.316Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-06T12:00:26.211Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/h3", "product": "h3", "vendor": "h3js", "versions": [{"lessThan": "2.0.1-rc.18", "status": "affected", "version": "2.0.0-beta.4", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.1-rc.18", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n\u00b2) cleanup loop that hangs the server process."}], "id": "CVE-2026-86250", "lastModified": "2026-09-18T18:17:18.657", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.7, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86250", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-18T17:07:52.002310Z", "version": "2.0.3"}}]}, "published": "2026-09-06T12:17:15.767", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-400"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "h3: h3: Denial of Service via unbounded chunked cookie processing", "id": "2529162", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529162"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-606", "details": ["h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n\u00b2) cleanup loop that hangs the server process.", "A flaw was found in h3. This vulnerability allows a remote attacker to send a specially crafted cookie header with an excessively large chunk count. This action triggers an inefficient cleanup process within the `setChunkedCookie()` and `deleteChunkedCookie()` functions, consuming significant server resources. Consequently, the server process can hang, leading to a denial of service (DoS) for legitimate users."], "mitigation": {"lang": "en:us", "value": "To mitigate this issue, restrict network access to services utilizing the h3 component, such as odh-feature-server-rhel9 in Red Hat OpenShift AI, to trusted clients and networks only. Implement firewall rules to limit exposure of the affected service ports. This operational control reduces the attack surface by preventing untrusted external access. If the service is reloaded or restarted, ensure firewall rules persist."}, "name": "CVE-2026-86250", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Affected", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-06T12:00:26Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86250\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86250\nhttps://github.com/h3js/h3/security/advisories/GHSA-q5pr-72pq-83v3\nhttps://www.vulncheck.com/advisories/h3-before-2.0.1-rc.18-denial-of-service-via-unbounded-chunked-cookie"], "statement": "Important: A denial of service flaw in the h3 library, affecting Red Hat OpenShift AI, allows a remote unauthenticated attacker to send a specially crafted cookie header. This can trigger an inefficient cleanup loop, leading to resource exhaustion and rendering the server unresponsive.", "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-beta.4,2.0.1-rc.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.0.1-rc.18"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "h3", "source": "cna", "vendor": "h3js"}, "product": "h3", "vendor": "h3js"}], "created": "2026-09-06T13:30:07.531637+00:00", "updated": "2026-09-21T06:15:10.495151+00:00", "vendors": ["h3js", "h3js$PRODUCT$h3"]}