The flaw allows an attacker to send a cookie header with an astronomically large chunk count that is parsed by setChunkedCookie() and deleteChunkedCookie() in h3. The library then enters an O(n²) cleanup loop during the cookie processing phase, causing the server process that runs h3 to hang and become unresponsive. This results in a denial of service to legitimate users. The weakness corresponds to improper input validation for a numeric value, which is reflected in the CWE-400 and CWE-606 classifications.

h3js’s h3 library, any deployment of h3 prior to version 2.0.1‑rc.18. No other version restrictions are specified in the CNA data. The vulnerability applies to all installations using the affected functions for cookie handling.

The CVSS score of 8.7 marks this as a high‑severity defect. EPSS score of 0.278% indicates a very low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalog, suggesting that while the likelihood of exploitation is low according to EPSS, the potential impact is serious. Attacks require the ability to provide a malicious HTTP request containing the crafted cookie; authentication is not needed. The attack vector is therefore inferred to be an unauthenticated remote HTTP request that the server will process normally. Successful exploitation will lead to a server hang, causing service degradation or outage until the process is restarted.