PT-2025-12045 · H2O.Ai · H2O-3

Published 2025-03-20 · Updated 2025-07-14 · CVE-2024-10550

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.46.0.1

Description A denial of service (DoS) attack can be performed by exploiting a vulnerability in the "/3/ParseSetup" endpoint. This endpoint applies a user-specified regular expression to a user-controllable string, which can be exploited by an attacker to cause inefficient regular expression complexity. This leads to the exhaustion of server resources, making the server unresponsive.

Recommendations For h2oai/h2o-3 version 3.46.0.1, consider disabling access to the "/3/ParseSetup" endpoint until a patch is available to prevent potential denial of service attacks. Additionally, restrict the ability for users to specify regular expressions in this endpoint to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-1333

Related Identifiers

CVE-2024-10550

GHSA-7QQ7-PVM9-X8RF

Affected Products

H2O-3

References · 8

• 🔥 https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6 · Exploit
• https://osv.dev/vulnerability/CVE-2024-10550 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-10550 · Security Note
• https://osv.dev/vulnerability/GHSA-7qq7-pvm9-x8rf · Vendor Advisory
• https://github.com/h2oai/h2o-3 · Note
• https://github.com/h2oai/h2o-3/blob/51c25940ded8b7d0acc8f3f72329fd9dedbb3a34/h2o-core/src/main/java/water/api/ParseSetupHandler.java#L121 · Note
• https://twitter.com/CVEnew/status/1902671148833181993 · Twitter Post
• https://t.me/cvenotify/128846 · Telegram Post