GitHub Advisoryadvisory · PyPI, Maven

GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

HIGH Published 2025-03-20 Modified 2025-03-20 Official page ↗
Aliases
CVE-2024-7768
Ecosystem
PyPI, Maven
Packages
h2o, ai.h2o:h2o-core
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400, CWE-770
Reviewed
2025-03-20

Affected packages

• PyPI h2o: <= 3.46.1 (no fix yet) • Maven ai.h2o:h2o-core: <= 3.46.1 (no fix yet)

Description

A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.

Related

Alias · CVE (1)

  • CVE-2024-7768 A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. vulnerability

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-770 Allocation of Resources Without Limits or Throttling weakness

References