HIGH 7.5 PyPI
H2O Vulnerable to Denial of Service (DoS) and File Write
GHSA-wjpv-64v2-2qpq · CVE-2024-10572 · PYSEC-2026-1444
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
In h2oai/h2o-3 version 3.46.0.1, the run_tool command exposes classes in the water.tools package through the ast parser. This includes the XGBoostLibExtractTool class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-10572
- PACKAGE https://github.com/h2oai/h2o-3
- WEB https://github.com/h2oai/h2o-3/blob/5e45e780f597961bda73adff765976db975f204b/h2o-extensions/xgboost/src/main/java/water/tools/XGBoostLibExtractTool.java#L12
- WEB https://huntr.com/bounties/db8939a0-9be8-4d0f-a8b0-1bd181666da2
Ready to move
Start Securing
Free, no credit card | First findings in minutes