https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 16:33:44 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-86250 <p>h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.</p> <p>h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-86250 https://vulnerability.circl.lu/vuln/ghsa-fg72-q65g-wm5w <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: h3</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-q5pr-72pq-83v3. This link is maintained to preserve external references.</p> <p>## Original Description h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> npm: h3</p> <p>## Duplicate Advisory</p> <p>This advisory has been withdrawn because it is a duplicate of GHSA-q5pr-72pq-83v3. This link is maintained to preserve external references.</p> <p>## Original Description h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.</p> https://vulnerability.circl.lu/vuln/ghsa-fg72-q65g-wm5w