A high-severity denial of service vulnerability in the h3 library allows unauthenticated remote attackers to crash server processes via malformed cookie headers.

This vulnerability is an uncontrolled resource consumption flaw (CWE-400) located in the setChunkedCookie and deleteChunkedCookie functions. Unauthenticated attackers can supply crafted cookie headers with excessive chunk counts to exhaust server resources.

The vulnerability carries a CVSS score of 7.5, reflecting a significant risk to service availability. Successful exploitation allows an attacker to hang the server process, leading to a complete denial of service for legitimate users. This can result in unplanned downtime, operational disruption, and potential loss of revenue or productivity for applications relying on the affected library.

Immediate Action: Update the h3 package to version 2.0.1-rc.18 or later to incorporate the necessary validation logic.

Proactive Monitoring: Monitor server CPU usage and process health for sudden, unexplained spikes or recurring process hangs that correlate with high volumes of HTTP requests.

Compensating Controls: Implement a Web Application Firewall (WAF) or ingress controller rule to inspect and block incoming HTTP requests containing unusually large or malformed Cookie headers.

Public Exploit Available: No (exploit_available: false)

Given the high impact on service availability and the ease of exploitation, teams should prioritize patching this dependency immediately. Organizations should verify their current version of h3 and apply the fix provided in version 2.0.1-rc.18 to prevent potential denial of service attacks against their infrastructure.