A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| H2o |
|
| H2oai |
|
No data.
References
History
Wed, 16 Jul 2025 13:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
epss
|
epss
|
Tue, 15 Jul 2025 16:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
H2o
H2o h2o |
|
| CPEs | cpe:2.3:a:h2o:h2o:3.46.1:*:*:*:*:*:*:* | |
| Vendors & Products |
H2o
H2o h2o |
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests. | |
| Title | Denial of Service in h2oai/h2o-3 | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-03-20T10:10:48.544Z
Updated: 2025-03-20T18:16:20.641Z
Reserved: 2024-08-13T18:55:25.587Z
Link: CVE-2024-7768
Vulnrichment
No data.
NVD
Status : Analyzed
Published: 2025-03-20T10:15:37.133
Modified: 2025-07-15T15:50:31.720
Link: CVE-2024-7768
Redhat
No data.