Vulnerabilities

TI-2026-25886 CVE-2026-33490 · GHSA-2j6q-whv2-gh6w

h3: Missing Path Segment Boundary Check in `mount()` Causes Middleware Execution on Unrelated Prefix-Matching Routes

MEDIUM 57

H3 is a minimal H(TTP) framework.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00248 Published 2026-03-26 Fixed in 2.0.1-rc.17 CWE-706

TI-2026-25562 CVE-2026-33131 · GHSA-3vj8-jmxq-cgj5

HIGH 74

H3 is a minimal H(TTP) framework.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00404 Published 2026-03-20 Fixed in 2.0.1-rc.15 CWE-290

TI-2026-25560 CVE-2026-33129 · GHSA-26f5-8h2x-34xh

MEDIUM 60

H3 is a minimal H(TTP) framework.

CVSS 3.1MEDIUM 5.9 Network No auth No interaction EPSS 0.00332 Published 2026-03-20 Fixed in 2.0.1-rc.9 CWE-208

TI-2026-25559 CVE-2026-33128 · GHSA-22cc-p3c6-wpvm

HIGH 76

H3 is a minimal H(TTP) framework.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00596 Published 2026-03-20 Fixed in 2.0.1-rc.15, 1.15.6 CWE-93

TI-2026-18951 CVE-2026-23527 · GHSA-mp2g-9vg9-f4cg

MEDIUM 44

H3 is a minimal H(TTP) framework built for high performance and portability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00626 Published 2026-01-15 Fixed in 1.15.5 CWE-444