CVE-2026-33128 HIGH

CVE-2026-33128: h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

Vendor H3Js
Product h3
Weakness CWE-93 · CRLF injection
Published March 20, 2026
Last update March 20, 2026
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity High
Privileges required None
User interaction None
Confidentiality Low
Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N

What the vulnerability does

01Description

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Key dates

02Disclosure timeline

March 20, 2026 CVE published
March 20, 2026 Record updated