Description

h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.3",
  "pubDate": "2026-09-06T12:17:16.033Z",
  "pubdate": "2026-09-06T12:17:16.033Z",
  "executiveSummary": "The h3 library, in versions prior to 1.15.9, is vulnerable to Server-Sent Events (SSE) injection due to insufficient sanitization of carriage return (\\r) characters within EventStream data and comment fields.\nThis vulnerability allows an attacker to manipulate the structure of SSE streams by injecting arbitrary directives or splitting responses, potentially bypassing previous security controls that only addressed newline (\\n) character injection.\nThe flaw affects how the application processes stream data before delivery to the browser, enabling attackers to perform protocol-level manipulation.\nBy crafting payloads containing carriage returns, attackers can influence browser-side event parsing, potentially leading to cross-site data injection or the initiation of unauthorized client-side event handlers.\nThe risk is categorized as high for applications relying on h3 for real-time data delivery via SSE, as it permits attackers to break out of intended field boundaries or define illegitimate event types.\nNo specific authentication or privilege requirements are noted for exploitation, as the vulnerability resides within the fundamental stream processing logic exposed to incoming data vectors.",
  "technicalDetails": "The root cause of this vulnerability is a failure in the sanitization logic within h3's SSE handling, which failed to account for carriage return (\\r) characters alongside newline (\\n) characters when validating EventStream data and comment fields.\nIn the SSE protocol, messages are delimited by sequences involving newlines and carriage returns. By injecting a \\r character, an attacker can manipulate how the browser's EventSource interface interprets the stream boundaries.\nAttack flow typically involves the injection of a \\r character into an application-controlled field that is subsequently emitted as part of an SSE stream. Once the stream is processed by the browser, the carriage return acts as a segment delimiter.\nThis allows an attacker to terminate the current event prematurely or inject new directive lines (e.g., 'event:', 'data:', 'id:') that the browser will process as separate, legitimate entities.\nSpecifically, an attacker can escape the confines of a comment field or a data payload by injecting a carriage return, effectively 'breaking out' of the intended field to inject new key-value pairs.\nBecause the previous patch specifically targeted \\n, the browser still interprets \\r as a valid carriage return character, which, depending on the browser's implementation, can be treated as a line-break or a control sequence that facilitates the injection of arbitrary SSE events.\nThe vulnerable component is the stream formatting module within h3, which improperly assumes that stripping \\n is sufficient to prevent protocol-level manipulation. This oversight leaves the application susceptible to event injection attacks where the attacker controls data eventually serialized into the SSE output.\nThe impact includes the ability to perform event type substitution, injecting 'event: <type>' directives into the stream to trigger arbitrary client-side listeners, or fragmenting a single legitimate data object into multiple unintended ones.\nThe vulnerability affects all h3 versions before 1.15.9. Exploitation is typically network-exposed, requiring only that the attacker can provide input that is eventually reflected in the server's SSE response stream, with no specific privileges required to initiate the injection."
}