CVE-2024-7765: H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

March 20, 2025

In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.

References

github.com/advisories/GHSA-6w62-3jvj-mfj6
github.com/h2oai/h2o-3
github.com/h2oai/h2o-3/blob/7d418fa19d3ab434f742818e37f891bef9102c97/h2o-core/src/main/java/water/parser/ParseDataset.java
huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff
nvd.nist.gov/vuln/detail/CVE-2024-7765

Code Behaviors & Features

Detect and mitigate CVE-2024-7765 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →