PT-2024-37289 · H2O.Ai · H2O-3

Published 2024-06-27 · Updated 2025-07-15 · CVE-2024-5979

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions: h2oai/h2o-3 version 3.46.0

Description: The issue allows the main function of any class under the water.tools namespace to be called through the run tool command in the rapids component. Specifically, the MojoConvertTool class can cause the server to crash when invoked with an invalid argument, resulting in a denial of service.

Recommendations: For h2oai/h2o-3 version 3.46.0, consider restricting access to the run tool command in the rapids component to prevent invocation of the MojoConvertTool class with invalid arguments until a patch is available.

Exploit

Fix

DoS

Resource Exhaustion

Code Injection

Weakness Enumeration

CWE-400

CWE-94

Related Identifiers

CVE-2024-5979

GHSA-58M3-RCVP-F9WW

Affected Products

H2O-3

References · 7

• 🔥 https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-5979 · Security Note
• https://osv.dev/vulnerability/GHSA-58m3-rcvp-f9ww · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-5979 · Vendor Advisory
• https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5 · Note
• https://github.com/h2oai/h2o-3 · Note
• https://t.me/cvenotify/129000 · Telegram Post