The h3 HTTP framework versions before 1.15.5 contain a critical vulnerability classified as CWE-444 (Inconsistent Interpretation of HTTP Requests, also known as HTTP Request Smuggling). The root cause is that the readRawBody function checks the Transfer-Encoding header for the value "chunked" in a case-sensitive manner, contrary to RFC specifications that mandate case-insensitive header interpretation. This discrepancy can be exploited to smuggle HTTP requests, causing the server to process requests differently than intended. The vulnerability has a CVSS 3.1 base score of 8.9, indicating high severity, with network attack vector, high impact on confidentiality and integrity, and low impact on availability. The issue is resolved in h3 version 1.15.5.

Successful exploitation of this vulnerability can lead to HTTP Request Smuggling attacks, which may allow attackers to bypass security controls, poison web caches, perform cross-user attacks, or gain unauthorized access to sensitive information. The CVSS score of 8.9 reflects a high impact on confidentiality and integrity, with a low impact on availability. There are no known exploits in the wild at the time of this report.

Upgrade to h3 version 1.15.5 or later, where this vulnerability is fixed by implementing a case-insensitive check for the Transfer-Encoding header. Since this is an official fix, applying the update is the recommended remediation. No alternative mitigations are indicated in the advisory.