PT-2026-5651 · H2O-3 · H2O-3

Published 2026-02-02 · Updated 2026-02-03 · CVE-2024-5986

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions h2o-3 version 3.46.0.1

Description A flaw exists in h2o-3 that permits remote attackers to write arbitrary data to any file on the server. The issue is due to exploiting the /3/Parse API endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the /3/Frames/framename/export API endpoint. Successful exploitation could lead to remote code execution and complete system access, including the ability to overwrite critical files like private SSH keys or script files. The vulnerable parameters are not explicitly mentioned.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-73

Related Identifiers

CVE-2024-5986

GHSA-WJ3H-WX8G-X699

Affected Products

H2O-3

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2024-5986 · Security Note
• https://osv.dev/vulnerability/GHSA-wj3h-wx8g-x699 · Vendor Advisory
• https://github.com/h2oai/h2o-3 · Note
• https://twitter.com/0dayPublishing/status/2018277328040624425 · Twitter Post
• https://twitter.com/CveFindCom/status/2018296172008350019 · Twitter Post
• https://twitter.com/pulsepatchio/status/2018699938788487515 · Twitter Post
• https://t.me/CVEtracker/43489 · Telegram Post
• https://huntr.com/bounties/64ff5319-6ac3-4447-87f7-b53495d4d5a3 · Note