CVE-2026-33128CWE-93

h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields

High · published March 20, 2026

CVSS v3.1
7.5
EPSS
1%
Percentile
53.1
In the wild
Unconfirmed
What it is

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00713 · 53.1th percentile
Weakness
CWE-93 · Improper Neutralization of CRLF Sequences ('CRLF Injection')
Published
2026-03-20T09:37Z
EPSS history
Timeline
  • 20 MAR 09:37Z
    h3 has a Server-Sent Events Injection via Unsanitized Newlines in Event Stream Fields
    cvelistv5