HIGH 7.5 PyPI
H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
GHSA-p2vc-m5fv-9w9m · CVE-2024-7768 · PYSEC-2026-1443
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A vulnerability in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
References
- ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2024-7768
- PACKAGE https://github.com/h2oai/h2o-3
- WEB https://github.com/h2oai/h2o-3/blob/7d418fa19d3ab434f742818e37f891bef9102c97/h2o-core/src/main/java/water/api/ImportFilesHandler.java#L19
- WEB https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6
Ready to move
Start Securing
Free, no credit card | First findings in minutes