A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.
Metrics
Affected Vendors & Products
References
History
Wed, 15 Oct 2025 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-400 |
Wed, 15 Oct 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-1333 |
Mon, 14 Jul 2025 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
H2o
H2o h2o |
|
| CPEs | cpe:2.3:a:h2o:h2o:3.46.0.1:*:*:*:*:*:*:* | |
| Vendors & Products |
H2o
H2o h2o |
Thu, 20 Mar 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service. | |
| Title | Denial of Service by ReDOS in h2oai/h2o-3 | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published: 2025-03-20T10:11:32.621Z
Updated: 2025-10-15T12:49:27.711Z
Reserved: 2024-10-30T16:35:38.176Z
Link: CVE-2024-10549
Vulnrichment
Updated: 2025-03-20T14:05:28.968Z
NVD
Status : Modified
Published: 2025-03-20T10:15:17.263
Modified: 2025-10-15T13:15:35.860
Link: CVE-2024-10549
Redhat
No data.