CVE-2024-10549: H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

March 20, 2025

A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.

References

github.com/advisories/GHSA-wwr9-4gmr-xvq9
github.com/h2oai/h2o-3
github.com/h2oai/h2o-3/blob/51c25940ded8b7d0acc8f3f72329fd9dedbb3a34/h2o-core/src/main/java/water/api/ParseHandler.java
huntr.com/bounties/ce7bd2d6-fd38-440d-a91a-dd8f3fc06bc2
nvd.nist.gov/vuln/detail/CVE-2024-10549

Code Behaviors & Features

Detect and mitigate CVE-2024-10549 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →