{"id":"CVE-2026-86251","title":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility","summary":"h3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives r…","severity":"medium","cvss":5.9,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","cwe":["CWE-22"],"vendor":"h3js","product":"h3","affected":["h3 < 1.15.9"],"published":"2026-09-06","updated":"2026-09-09","sourceUpdated":"2026-09-09T14:17:21.977","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-86251","references":[{"url":"https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw","label":"disclosure@vulncheck.com"},{"url":"https://www.vulncheck.com/advisories/h3-before-1.15.9-path-traversal-via-double-decoding","label":"disclosure@vulncheck.com"},{"url":"https://github.com/h3js/h3/security/advisories/GHSA-72gr-qfp7-vwhw","label":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86251.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-86251"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529161"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-86251"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-86251"}],"tags":["nvd","cve.org","exploit-available","csaf","vex","red-hat"],"exploitAvailable":true,"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-09-09T13:57:13.508362Z"},"epss":0.00297,"epssPercentile":0.22553,"ingestedAt":"2026-09-07T04:04:50.495Z","slug":"CVE-2026-86251","body":"## Overview\n\nh3 versions before 1.15.9 contain a path traversal vulnerability in the serveStatic utility. A double-decoding flaw allows a request path containing double-encoded dot sequences (e.g. %252e%252e) to be decoded to %2e%2e, which survives resolveDotSegments() because that function only checks for literal '.' characters. When the resulting asset ID is resolved by URL-based backends (CDN, S3, object storage), %2e%2e is interpreted as '..' per RFC 3986, enabling path traversal to read arbitrary files from the backend.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift AI (RHOAI) · no fix planned: Red Hat OpenShift AI (RHOAI) · updated 2026-09-18 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-86251.json)","depth":"twilight","depthScore":45,"depthScoreParts":{"impact":32.5,"likelihood":0.1,"exploitation":12,"ransomware":0},"changes":[{"seq":202102,"id":"CVE-2026-86251","ts":1789400062640,"field":"exploit_available","old":"false","new":"true"},{"seq":200829,"id":"CVE-2026-86251","ts":1789397616626,"field":"exploit_available","old":"true","new":"false"},{"seq":199522,"id":"CVE-2026-86251","ts":1789395529163,"field":"exploit_available","old":"false","new":"true"},{"seq":198767,"id":"CVE-2026-86251","ts":1789392244364,"field":"exploit_available","old":"true","new":"false"},{"seq":197100,"id":"CVE-2026-86251","ts":1789384292626,"field":"exploit_available","old":"false","new":"true"},{"seq":194229,"id":"CVE-2026-86251","ts":1789378783283,"field":"exploit_available","old":"true","new":"false"},{"seq":193016,"id":"CVE-2026-86251","ts":1789376515322,"field":"exploit_available","old":"false","new":"true"},{"seq":191803,"id":"CVE-2026-86251","ts":1789373631314,"field":"exploit_available","old":"true","new":"false"},{"seq":190588,"id":"CVE-2026-86251","ts":1789369475955,"field":"exploit_available","old":"false","new":"true"},{"seq":189375,"id":"CVE-2026-86251","ts":1789368418545,"field":"exploit_available","old":"true","new":"false"},{"seq":188158,"id":"CVE-2026-86251","ts":1789365231010,"field":"exploit_available","old":"false","new":"true"},{"seq":186945,"id":"CVE-2026-86251","ts":1789363471482,"field":"exploit_available","old":"true","new":"false"},{"seq":185731,"id":"CVE-2026-86251","ts":1789361229369,"field":"exploit_available","old":"false","new":"true"},{"seq":184518,"id":"CVE-2026-86251","ts":1789358363978,"field":"exploit_available","old":"true","new":"false"},{"seq":182769,"id":"CVE-2026-86251","ts":1789354317418,"field":"exploit_available","old":"false","new":"true"},{"seq":181562,"id":"CVE-2026-86251","ts":1789353317908,"field":"exploit_available","old":"true","new":"false"},{"seq":180355,"id":"CVE-2026-86251","ts":1789350284946,"field":"exploit_available","old":"false","new":"true"},{"seq":179148,"id":"CVE-2026-86251","ts":1789348293145,"field":"exploit_available","old":"true","new":"false"},{"seq":177941,"id":"CVE-2026-86251","ts":1789346370259,"field":"exploit_available","old":"false","new":"true"},{"seq":176734,"id":"CVE-2026-86251","ts":1789343184728,"field":"exploit_available","old":"true","new":"false"},{"seq":174851,"id":"CVE-2026-86251","ts":1789334875934,"field":"exploit_available","old":"false","new":"true"},{"seq":173646,"id":"CVE-2026-86251","ts":1789333693032,"field":"exploit_available","old":"true","new":"false"},{"seq":172460,"id":"CVE-2026-86251","ts":1789331093280,"field":"exploit_available","old":"false","new":"true"},{"seq":171274,"id":"CVE-2026-86251","ts":1789328781095,"field":"exploit_available","old":"true","new":"false"},{"seq":170069,"id":"CVE-2026-86251","ts":1789327197403,"field":"exploit_available","old":"false","new":"true"},{"seq":168864,"id":"CVE-2026-86251","ts":1789323840324,"field":"exploit_available","old":"true","new":"false"},{"seq":167659,"id":"CVE-2026-86251","ts":1789319702853,"field":"exploit_available","old":"false","new":"true"},{"seq":166454,"id":"CVE-2026-86251","ts":1789318776346,"field":"exploit_available","old":"true","new":"false"},{"seq":165249,"id":"CVE-2026-86251","ts":1789315790813,"field":"exploit_available","old":"false","new":"true"},{"seq":164044,"id":"CVE-2026-86251","ts":1789313634483,"field":"exploit_available","old":"true","new":"false"},{"seq":162839,"id":"CVE-2026-86251","ts":1789311903696,"field":"exploit_available","old":"false","new":"true"},{"seq":161634,"id":"CVE-2026-86251","ts":1789308733411,"field":"exploit_available","old":"true","new":"false"},{"seq":159747,"id":"CVE-2026-86251","ts":1789300470793,"field":"exploit_available","old":"false","new":"true"},{"seq":156736,"id":"CVE-2026-86251","ts":1789294755902,"field":"exploit_available","old":"true","new":"false"},{"seq":155531,"id":"CVE-2026-86251","ts":1789292968180,"field":"exploit_available","old":"false","new":"true"},{"seq":154326,"id":"CVE-2026-86251","ts":1789289797802,"field":"exploit_available","old":"true","new":"false"},{"seq":151577,"id":"CVE-2026-86251","ts":1789277630096,"field":"exploit_available","old":"false","new":"true"},{"seq":150538,"id":"CVE-2026-86251","ts":1789276245937,"field":"exploit_available","old":"true","new":"false"},{"seq":149505,"id":"CVE-2026-86251","ts":1789273824953,"field":"exploit_available","old":"false","new":"true"},{"seq":148472,"id":"CVE-2026-86251","ts":1789271348955,"field":"exploit_available","old":"true","new":"false"},{"seq":146503,"id":"CVE-2026-86251","ts":1789269398274,"field":"exploit_available","old":"false","new":"true"},{"seq":145308,"id":"CVE-2026-86251","ts":1789266340065,"field":"exploit_available","old":"true","new":"false"},{"seq":144212,"id":"CVE-2026-86251","ts":1789262616979,"field":"exploit_available","old":"false","new":"true"},{"seq":143116,"id":"CVE-2026-86251","ts":1789261533647,"field":"exploit_available","old":"true","new":"false"},{"seq":141947,"id":"CVE-2026-86251","ts":1789258832051,"field":"exploit_available","old":"false","new":"true"},{"seq":140788,"id":"CVE-2026-86251","ts":1789256727356,"field":"exploit_available","old":"true","new":"false"},{"seq":139590,"id":"CVE-2026-86251","ts":1789254832304,"field":"exploit_available","old":"false","new":"true"},{"seq":138392,"id":"CVE-2026-86251","ts":1789251934428,"field":"exploit_available","old":"true","new":"false"},{"seq":137194,"id":"CVE-2026-86251","ts":1789247833025,"field":"exploit_available","old":"false","new":"true"},{"seq":135996,"id":"CVE-2026-86251","ts":1789247056259,"field":"exploit_available","old":"true","new":"false"}]}