A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6 | Exploit Third Party Advisory |
Configurations
History
14 Jul 2025, 13:49
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:h2o:h2o:3.46.0.1:*:*:*:*:*:*:* | |
| First Time |
H2o
H2o h2o |
|
| References | () https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6 - Exploit, Third Party Advisory |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-14 13:49
NVD link : CVE-2024-10550
Mitre link : CVE-2024-10550
JSON object : View
Products Affected
h2o
- h2o
CWE
CWE-1333
Inefficient Regular Expression Complexity