Denial of Service Vulnerability in h2oai/h2o-3 by H2O.ai

CVE-2024-10549

What is CVE-2024-10549?

A vulnerability exists in the /3/Parse endpoint of h2oai/h2o-3 (version 3.46.0.1), which can be exploited to execute a denial of service (DoS) attack. This vulnerability arises when user input is used to construct a regular expression applied to another user input string. By sending multiple simultaneous requests to this endpoint, an attacker can overwhelm the server's thread capacity, resulting in a complete service outage.

References