Description

h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.5",
  "pubDate": "2026-09-06T12:17:15.767Z",
  "pubdate": "2026-09-06T12:17:15.767Z",
  "executiveSummary": "The h3 library is susceptible to a Denial-of-Service (DoS) vulnerability originating from improper validation of user-controlled cookie data. Specifically, the setChunkedCookie() and deleteChunkedCookie() functions fail to sanitize the chunk count parameter derived from cookie headers.\nBy submitting a maliciously crafted cookie header containing an excessively large integer for the chunk count, an unauthenticated remote attacker can trigger an algorithmic complexity issue. This forces the server to enter an O(n²) cleanup loop during the cookie parsing or deletion process.\nThe vulnerability leads to significant CPU exhaustion, effectively hanging the server process and rendering the application unavailable to legitimate users. The flaw exists in all versions of h3 prior to 2.0.1-rc.18. Given the nature of the attack, it requires no special privileges or authentication, as it exploits the initial request handling phase of the web framework. Organizations utilizing affected versions are at high risk of service disruption if exposed to the public internet, necessitating an immediate upgrade to version 2.0.1-rc.18 or later to enforce proper bounds checking on cookie metadata.",
  "technicalDetails": "The vulnerability resides within the cookie management logic of the h3 library, specifically targeting the handling of chunked cookies. Chunking is a mechanism used to store larger cookie values across multiple smaller cookie headers when individual cookie sizes exceed browser or protocol limits. The functions setChunkedCookie() and deleteChunkedCookie() are responsible for coordinating these chunks; however, they rely on a chunk count value extracted directly from user-provided input without enforcing any security boundaries or maximum limits.\nThe root cause is an insecure loop iteration pattern. When the library processes these cookies, it attempts to clean up or iterate through the defined number of chunks. Because the chunk count is sourced from an untrusted cookie header, an attacker can supply an arbitrarily large value. When the server attempts to iterate through this range, the internal logic triggers an O(n²) cleanup operation. The computational complexity grows quadratically relative to the malicious input, leading to a state of resource exhaustion where the event loop or thread responsible for the request becomes blocked indefinitely.\nThe attack flow follows a predictable sequence: First, the attacker identifies an application endpoint utilizing h3 for session or state management via chunked cookies. Second, the attacker crafts a malicious HTTP request featuring a header that defines a massive number of chunks. Third, upon reaching the application server, the h3 parser interprets the header and passes the unvalidated count to the vulnerable cleanup functions. Finally, the application executes the loop proportional to the attacker-supplied value, consuming excessive CPU cycles and blocking other concurrent requests, resulting in a persistent Denial-of-Service state for the affected service instance.\nThis vulnerability is particularly impactful because it does not require authentication or elevated privileges, making it accessible to any remote actor capable of reaching the application interface. The lack of validation on the chunk metadata acts as a vector for resource exhaustion attacks that circumvent standard rate-limiting if the application is not configured to inspect the structure of incoming cookie headers before deeper processing by the h3 framework. Affected versions are all releases preceding 2.0.1-rc.18, which introduced the necessary input validation to sanitize the chunk count before loop execution."
}