HIGH 7.5 PyPI
h2o vulnerable to unexpected POST request shutting down server
GHSA-58m3-rcvp-f9ww · CVE-2024-5979 · PYSEC-2026-1437
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
In h2oai/h2o-3 version 3.46.0, the run_tool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service.
Ready to move
Start Securing
Free, no credit card | First findings in minutes