What is CVE-2026-33128?

CVE-2026-33128 is a high-severity vulnerability in H3, classified under CRLF Injection. CVSS score: 7.5/10. Published 2026-03-20.

How severe is CVE-2026-33128?

High severity. CVSS v3 base score is 7.5 out of 10.

Vulnerability in H3

CVE-2026-33128

H3 is a minimal H(TTP) framework. In versions prior to 1.15.6 and between 2.0.0 through 2.0.1-rc.14, createEventStream is vulnerable to Server-Sent Events (SSE) injection due to missing newline sanitization in formatEventStreamMessage() and formatEventStreamComment(). An attacker who controls any part of an SSE message field (id, event, data, or comment) can inject arbitrary SSE events to connected clients. This issue is fixed in versions 1.15.6 and 2.0.1-rc.15.

Vulnerability class: CRLF Injection

EPSS: 0.006 (44.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:H/A:N.

Affected products

H3 — versions 2.0.0, 2.0.1
H3js H3 — versions >= 2.0.0, < 2.0.1-rc.15, < 1.15.6

Weakness classification (CWE)

CWE-93 — CRLF Injection

References

security-advisories@github.com (x_refsource_CONFIRM, Exploit, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Product, x_refsource_MISC)

Frequently asked questions

What is CVE-2026-33128?: CVE-2026-33128 is a high-severity vulnerability in H3, classified under CRLF Injection. CVSS score: 7.5/10. Published 2026-03-20.
How severe is CVE-2026-33128?: High severity. CVSS v3 base score is 7.5 out of 10.