CVE-2026-23527
h3 v1 has Request Smuggling (TE.TE) issue
Résumé
h3 v1 has Request Smuggling (TE.TE) issue
Description d'origine
La description telle que publiée par la source (souvent en anglais).
H3 is a minimal H(TTP) framework built for high performance and portability. Prior to 1.15.5, there is a critical HTTP Request Smuggling vulnerability. readRawBody is doing a strict case-sensitive check for the Transfer-Encoding header. It explicitly looks for "chunked", but per the RFC, this header should be case-insensitive. This vulnerability is fixed in 1.15.5.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- web github.com
- web simonkoeck.com