CVE-2026-86252

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-86252", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "state": "PUBLISHED", "assignerShortName": "VulnCheck", "dateReserved": "2026-09-06T11:35:19.316Z", "datePublished": "2026-09-06T12:00:27.561Z", "dateUpdated": "2026-09-08T15:13:40.142Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-06T12:00:27.561Z"}, "datePublic": "2026-03-20T00:00:00.000Z", "title": "h3 before 1.15.9 SSE Event Injection via Carriage Return", "descriptions": [{"lang": "en", "value": "h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')", "cweId": "CWE-74", "type": "CWE"}]}], "affected": [{"vendor": "h3js", "product": "h3", "defaultStatus": "unaffected", "packageURL": "pkg:npm/h3", "versions": [{"version": "0", "status": "affected", "lessThan": "1.15.9", "versionType": "semver"}, {"version": "1.15.9", "status": "unaffected", "versionType": "semver"}, {"version": "2.0.0-beta.0", "status": "affected", "lessThan": "2.0.1-rc.17", "versionType": "semver"}, {"version": "2.0.1-rc.17", "status": "unaffected", "versionType": "semver"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM"}}, {"format": "CVSS", "cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM"}}], "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385", "tags": ["vendor-advisory"], "name": "GitHub Security Advisory (GHSA-4hxc-9384-m385)"}, {"name": "VulnCheck Advisory: h3 before 1.15.9 SSE Event Injection via Carriage Return", "tags": ["third-party-advisory"], "url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return"}], "credits": [{"lang": "en", "value": "offset", "type": "reporter"}], "x_generator": {"engine": "vulncheck-endgame"}}, "adp": [{"references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-08T15:11:57.605320Z", "id": "CVE-2026-86252", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T15:13:40.142Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-86252", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-09-08T15:11:57.605320Z"}}}], "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-08T15:12:19.288Z"}}], "cna": {"title": "h3 before 1.15.9 SSE Event Injection via Carriage Return", "credits": [{"lang": "en", "type": "reporter", "value": "offset"}], "metrics": [{"format": "CVSS", "cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE"}}, {"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "h3js", "product": "h3", "versions": [{"status": "affected", "version": "0", "lessThan": "1.15.9", "versionType": "semver"}, {"status": "unaffected", "version": "1.15.9", "versionType": "semver"}, {"status": "affected", "version": "2.0.0-beta.0", "lessThan": "2.0.1-rc.17", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.1-rc.17", "versionType": "semver"}], "packageURL": "pkg:npm/h3", "defaultStatus": "unaffected"}], "datePublic": "2026-03-20T00:00:00.000Z", "references": [{"url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385", "name": "GitHub Security Advisory (GHSA-4hxc-9384-m385)", "tags": ["vendor-advisory"]}, {"url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return", "name": "VulnCheck Advisory: h3 before 1.15.9 SSE Event Injection via Carriage Return", "tags": ["third-party-advisory"]}], "x_generator": {"engine": "vulncheck-endgame"}, "descriptions": [{"lang": "en", "value": "h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-74", "description": "Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')"}]}], "providerMetadata": {"orgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "shortName": "VulnCheck", "dateUpdated": "2026-09-06T12:00:27.561Z"}}}, "cveMetadata": {"cveId": "CVE-2026-86252", "state": "PUBLISHED", "dateUpdated": "2026-09-08T15:13:40.142Z", "dateReserved": "2026-09-06T11:35:19.316Z", "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10", "datePublished": "2026-09-06T12:00:27.561Z", "assignerShortName": "VulnCheck"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageURL": "pkg:npm/h3", "product": "h3", "vendor": "h3js", "versions": [{"lessThan": "1.15.9", "status": "affected", "version": "0", "versionType": "semver"}, {"status": "unaffected", "version": "1.15.9", "versionType": "semver"}, {"lessThan": "2.0.1-rc.17", "status": "affected", "version": "2.0.0-beta.0", "versionType": "semver"}, {"status": "unaffected", "version": "2.0.1-rc.17", "versionType": "semver"}]}], "source": "disclosure@vulncheck.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection."}], "id": "CVE-2026-86252", "lastModified": "2026-09-08T20:00:18.870", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "disclosure@vulncheck.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-86252", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-09-08T15:11:57.605320Z", "version": "2.0.3"}}]}, "published": "2026-09-06T12:17:16.033", "references": [{"source": "disclosure@vulncheck.com", "url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"}, {"source": "disclosure@vulncheck.com", "url": "https://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385"}], "sourceIdentifier": "disclosure@vulncheck.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "disclosure@vulncheck.com", "type": "Secondary"}]}

{"bugzilla": {"description": "h3: h3: Server-Sent Events (SSE) injection via carriage return", "id": "2529158", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2529158"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-93", "details": ["h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.", "A flaw was found in h3. This vulnerability allows a remote attacker to inject arbitrary Server-Sent Events (SSE) by failing to sanitize carriage return characters in EventStream data and comment fields. Attackers can manipulate event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, potentially leading to integrity issues."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-86252", "package_state": [{"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Fix deferred", "package_name": "rhoai/odh-feature-server-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}], "public_date": "2026-09-06T12:00:27Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-86252\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-86252\nhttps://github.com/h3js/h3/security/advisories/GHSA-4hxc-9384-m385\nhttps://www.vulncheck.com/advisories/h3-before-1.15.9-sse-event-injection-via-carriage-return"], "statement": "This Moderate severity flaw in the `h3` library, utilized by Red Hat OpenShift AI, allows for Server-Sent Events (SSE) injection. Improper sanitization of carriage return characters enables attackers to inject arbitrary SSE events, potentially leading to data manipulation or bypassing existing security controls. This issue arises from a failure to adequately sanitize input in EventStream data and comment fields.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,1.15.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "1.15.9"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0-beta.0,2.0.1-rc.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "2.0.1-rc.17"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "h3", "source": "cna", "vendor": "h3js"}, "product": "h3", "vendor": "h3js"}], "created": "2026-09-06T13:30:07.830633+00:00", "updated": "2026-09-21T06:15:10.494277+00:00", "vendors": ["h3js", "h3js$PRODUCT$h3"]}