A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6 | Exploit Third Party Advisory |
Configurations
History
15 Jul 2025, 15:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6 - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:h2o:h2o:3.46.1:*:*:*:*:*:*:* | |
| First Time |
H2o
H2o h2o |
20 Mar 2025, 10:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-03-20 10:15
Updated : 2025-07-15 15:50
NVD link : CVE-2024-7768
Mitre link : CVE-2024-7768
JSON object : View
Products Affected
h2o
- h2o
CWE
CWE-400
Uncontrolled Resource Consumption