CVE-2026-33490

[CVE catalog]

Severity

Medium · CVSS 6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Published

Mar 26, 2026, 5:19:15 PM UTC

Source

[NVD] · [CVE record]

EPSS

0.25% · Oct 25, 2026

A flaw was found in H3, a minimal HTTP framework. The `mount()` method, responsible for routing requests to sub-applications, incorrectly uses a simple string comparison to check path prefixes. This allows a remote attacker to craft a URL that bypasses the intended path segment boundary. Consequently, middleware designed for specific administrative paths could be triggered for unrelated public paths, potentially leading to the exposure of sensitive information or unintended access due to incorrect privilege flags being set in the request context. h3: H3: Information disclosure due to incorrect path prefix validation A Moderate flaw in the `h3` framework's `mount()` method allows for incorrect path prefix validation. This can lead to middleware intended for specific administrative paths being triggered for unrelated public paths, potentially exposing sensitive information or granting unintended access. Red Hat OpenShift Container Platform components are not affected as the vulnerable code is not present. Fedora versions 42 and 43 are affected. The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.