Vulnerability · Published Mar 20, 2025 · Assigned by @huntr_ai

CVE-2024-7768Denial of Service in h2oai/h2o-3

High 7.5

In plain English

A high-severity resource allocation without limits in h2oai/h2o-3 from h2oai. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).

Severity (CVSS 3.0)7.5High

Exploit odds (30 days)0.8%top 43.6% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	ai.h2o:h2o-core	no fix listed	GHSA-p2vc-m5fv-9w9m
PyPI	h2o	no fix listed	GHSA-p2vc-m5fv-9w9m
PyPI	h2o	no fix listed	PYSEC-2026-1443

Affected products (as reported)

Vendor	Product	Versions
h2oai	h2oai/h2o-3	unspecified – through latest

Weakness: CWE-770 · Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References

https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6