CVE-2026-33129

Published: Mar 20, 2026Modified: Jun 17, 2026

5.9

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 2.2 / Impact: 3.6

Source: NVD

Description

H3 is a minimal H(TTP) framework. Versions 2.0.1-beta.0 through 2.0.0-rc.8 contain a Timing Side-Channel vulnerability in the requireBasicAuth function due to the use of unsafe string comparison (!==). This allows an attacker to deduce the valid password character-by-character by measuring the server's response time, effectively bypassing password complexity protections. This issue is fixed in version 2.0.1-rc.9.

Affected (9)

Products: H3: H3

1 product

Configuration A

9 vulnerable

Vulnerable Software	Affected Versions
H3 H3	Version 2.0.0
H3 H3	Version 2.0.1 rc1
H3 H3	Version 2.0.1 rc2
H3 H3	Version 2.0.1 rc3
H3 H3	Version 2.0.1 rc4
H3 H3	Version 2.0.1 rc5
H3 H3	Version 2.0.1 rc6
H3 H3	Version 2.0.1 rc7
H3 H3	Version 2.0.1 rc8

Related CWEs

CWE-208

Observable Timing Discrepancy

Two separate operations in a product require different amounts of time to complete, in a way that is observable to an actor and reveals security-relevant information about the state of the product, such as whether a particular operation was successful or not.

References (3)

https://github.com/h3js/h3/pull/1283

Source: security-advisories@github.com

Issue Tracking

https://github.com/h3js/h3/releases/tag/v2.0.1-rc.9

Source: security-advisories@github.com

Patch

https://github.com/h3js/h3/security/advisories/GHSA-26f5-8h2x-34xh

Source: security-advisories@github.com

ExploitVendor Advisory

Timeline

No history available yet.