Denial of Service Vulnerability in h2oai/h2o-3 from H2O.ai

CVE-2024-7768

What is CVE-2024-7768?

A vulnerability exists in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1 that can be exploited to trigger a denial of service condition. By manipulating a single GET parameter, path, an attacker can create a situation where the endpoint recursively references itself. This leads to the server repeatedly calling its own endpoint, ultimately overwhelming the request queue and hindering the server’s ability to process legitimate requests. Prompt action is advised to mitigate potential service disruptions.

References