CVE-2026-86250: h3 before 2.0.1-rc.18 Denial of Service via Unbounded Chunked Cookie
h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
h3to a version that resolves this vulnerability.Fixed in 2.0.1-rc.18 - Compensating control
Apply a compensating mitigation to prevent crafted requests from exhausting server resources until the h3 upgrade to 2.0.1-rc.18 is deployed (e.g., drop/rate-limit requests with unusually large chunk counts in the Cookie header at the network/WAF layer).
Event History
Frequently Asked Questions
Who can exploit this issue?
Any unauthenticated remote attacker able to send HTTP requests with crafted Cookie headers to an affected h3 server can trigger the vulnerable cookie-processing path.
What is required to trigger the denial of service?
The attacker needs to supply a cookie value containing an extremely large chunk count. The affected functions do not validate that count, causing an O(n²) cleanup loop that can hang the server process.
Which versions are affected?
h3 versions before 2.0.1-rc.18 are affected. Upgrading to 2.0.1-rc.18 or a later version removes the stated affected version range.