CyberRota Analysis
AI-GeneratedVersions of h3 prior to 1.15.9 are vulnerable due to inadequate sanitization of carriage return characters in EventStream data and comment fields, enabling attackers to inject arbitrary Server-Sent Events (SSE). This can lead to manipulation of event types, fragmentation of push calls into multiple events, or data injection that circumvents previous security fixes. Organizations using affected h3 versions should prioritize updating to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
h3 versions before 1.15.9 fail to sanitize carriage return characters in EventStream data and comment fields, allowing attackers to inject arbitrary SSE events by including unsanitized carriage returns. Attackers can inject event type directives, split single push calls into multiple browser-parsed events, or escape comment fields to inject data, bypassing the prior CVE fix that only addressed newline injection.