Denial of Service Vulnerability in h2oai/h2o-3 from H2O.ai

CVE-2024-7768

What is CVE-2024-7768?

A vulnerability exists in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1 that can be exploited to trigger a denial of service condition. By manipulating a single GET parameter, path, an attacker can create a situation where the endpoint recursively references itself. This leads to the server repeatedly calling its own endpoint, ultimately overwhelming the request queue and hindering the server’s ability to process legitimate requests. Prompt action is advised to mitigate potential service disruptions.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch →

References