PT-2025-12188 · H2O.Ai · H2O-3

Published 2025-03-20 · Updated 2025-03-22 · CVE-2024-7765

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 version 3.46.0.2

Description A denial of service issue occurs when uploading and repeatedly parsing a large GZIP file, causing the server to become unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This is caused by the improper handling of highly compressed data, leading to significant data amplification.

Recommendations For version 3.46.0.2, consider restricting the upload and parsing of large GZIP files to prevent memory exhaustion and denial of service. As a temporary workaround, limit the number of concurrent jobs to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Weakness Enumeration

CWE-409

Related Identifiers

CVE-2024-7765

GHSA-6W62-3JVJ-MFJ6

Affected Products

H2O-3

References · 7

• 🔥 https://huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff · Exploit
• https://osv.dev/vulnerability/CVE-2024-7765 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-7765 · Security Note
• https://osv.dev/vulnerability/GHSA-6w62-3jvj-mfj6 · Vendor Advisory
• https://github.com/h2oai/h2o-3 · Note
• https://github.com/h2oai/h2o-3/blob/7d418fa19d3ab434f742818e37f891bef9102c97/h2o-core/src/main/java/water/parser/ParseDataset.java#L900 · Note
• https://twitter.com/CVEnew/status/1903336858622271553 · Twitter Post