h3 versions before 2.0.1-rc.18 fail to validate the chunk count parsed from user-controlled cookie values in setChunkedCookie() and deleteChunkedCookie() functions. Attackers can send a crafted cookie header with an extremely large chunk count to trigger an O(n²) cleanup loop that hangs the server process.

A denial-of-service vulnerability exists in h3 versions prior to 2.0.1-rc.18, affecting the setChunkedCookie() and deleteChunkedCookie() functions. The library fails to validate the chunk count parsed from user-controlled cookie values, allowing attackers to send a crafted cookie header with an extremely large chunk count. This triggers an O(n²) cleanup loop that can hang the server process indefinitely. The vulnerability is exploitable remotely without authentication by simply sending a malicious HTTP cookie header. The issue has been addressed in h3 version 2.0.1-rc.18. Affected users should upgrade immediately to mitigate the risk of service disruption.