Skip to content

[Aikido] Fix critical issue in h3 via minor version upgrade from 1.15.1 to 1.15.5#28

Open
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/-security-issue'supdate-packages-16134097-bWAA
Open

[Aikido] Fix critical issue in h3 via minor version upgrade from 1.15.1 to 1.15.5#28
aikido-autofix[bot] wants to merge 1 commit intomainfrom
fix/-security-issue'supdate-packages-16134097-bWAA

Conversation

@aikido-autofix
Copy link
Contributor

This pull request addresses identified vulnerabilities and implements the necessary fixes to strengthen our security posture. Please review and approve so we can merge these changes promptly and reduce potential risk.

Any issues, please ping me, Alan Sower.

Thanks Team

Patches critical HTTP request smuggling vulnerability enabling potential request manipulation and bypassing security controls in H3 framework.

✅ Code not affected by breaking changes.

No breaking changes affect this codebase. The affected methods readBody(event) and readRawBody(event) are not used anywhere in the codebase.

All breaking changes by upgrading h3 from version 1.15.1 to 1.15.5 (CHANGELOG)

Version Description
1.15.5
Fixed case-sensitive Transfer-Encoding check in readBody(event) and readRawBody(event) that could cause request bodies to be ignored with certain header formats, potentially breaking code that relied on the previous (non-compliant) behavior
✅ 1 CVE resolved by this upgrade, including 1 critical 🚨 CVE

This PR will resolve the following CVEs:

Issue Severity           Description
CVE-2026-23527
🚨 CRITICAL
[h3] HTTP Request Smuggling vulnerability allows attackers to bypass request parsing checks by using case-variant Transfer-Encoding headers, potentially enabling manipulation of HTTP request boundaries and server-side request processing.
🔗 Related Tasks

@aikido-autofix aikido-autofix bot added the aikido Label created by Aikido AutoFix label Feb 12, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

aikido Label created by Aikido AutoFix

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants