CVE-2024-7768High· 7.5▾ TwilightH2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Jul 8.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
0.7%
Last analysed / modified upstream
0.7% → 0.8%
A vulnerability in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
h2o <= 3.46.1ai.h2o:h2o-core <= 3.46.1Refer to the advisory for the patched release.
Connected by shared product, vendor, weakness, or advisory.
CVE-2024-5550Medium· 5.3Arbitrary system path lookup in h20
CVE-2024-10549High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
CVE-2024-10572High· 7.5H2O Vulnerable to Denial of Service (DoS) and File Write
CVE-2024-6863Medium· 6.5H2O Vulnerable to Execution of Arbitrary Files
CVE-2024-8616High· 8.2H2O Vulnerable to Arbitrary File Overwrite
CVE-2024-10550High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint