FKIE_CVE-2026-23527

Vulnerability from fkie_nvd - Published: 2026-01-15 20:16 - Updated: 2026-06-17 10:21
Severity
8.9 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L
9.8 (Critical) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Summary
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.
References
security-advisories@github.comhttps://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097Patch
security-advisories@github.comhttps://github.com/h3js/h3/releases/tag/v1.15.5
security-advisories@github.comhttps://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cgExploit, Vendor Advisory
security-advisories@github.comhttps://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling
Impacted products
Vendor Product Version
h3 h3 *
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "h3",
          "vendor": "h3js",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 1.15.5"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:h3:h3:*:*:*:*:*:node.js:*:*",
              "matchCriteriaId": "8AEE0C29-3BA5-4765-82CB-0CE73ACCEB77",
              "versionEndExcluding": "1.15.5",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for \"chunked\", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5."
    },
    {
      "lang": "es",
      "value": "H3 es un framework H(TTP) m\u00ednimo dise\u00f1ado para alto rendimiento y portabilidad. Antes de 1.15.5, existe una vulnerabilidad cr\u00edtica de contrabando de solicitudes HTTP. readRawBody realiza una comprobaci\u00f3n estricta sensible a may\u00fasculas y min\u00fasculas para el encabezado Transfer-Encoding. Busca expl\u00edcitamente \u0027chunked\u0027, pero seg\u00fan la RFC, este encabezado deber\u00eda ser insensible a may\u00fasculas y min\u00fasculas. Esta vulnerabilidad est\u00e1 corregida en 1.15.5."
    }
  ],
  "id": "CVE-2026-23527",
  "lastModified": "2026-06-17T10:21:43.847",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "LOW",
          "baseScore": 8.9,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "CHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:L",
          "version": "3.1"
        },
        "exploitabilityScore": 2.2,
        "impactScore": 6.0,
        "source": "security-advisories@github.com",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-23527",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-01-15T19:59:57.020909Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-01-15T20:16:05.620",
  "references": [
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Patch"
      ],
      "url": "https://github.com/h3js/h3/commit/618ccf4f37b8b6148bea7f36040471af45bfb097"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/h3js/h3/releases/tag/v1.15.5"
    },
    {
      "source": "security-advisories@github.com",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "url": "https://github.com/h3js/h3/security/advisories/GHSA-mp2g-9vg9-f4cg"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://simonkoeck.com/writeups/h3-transfer-encoding-request-smuggling"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-444"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.