GHSA-5c8j-g96x-cj78 CVE-2024-8062 PYSEC-2026-1438
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.48%
- Chance of exploitation in the next 30 days. Higher than 41.61% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1088 Synchronous Access of Remote Resource without Timeout
- Fix
- None yet
- No fixed version published
Description
A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a HEAD request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| ai.h2o:h2o-core | >= 3.2.0.1, <= 3.46.0 |
No fix yet |
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| h2o | >= 3.2.0.1, <= 3.46.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1088: Synchronous Access of Remote Resource without Timeout
The code has a synchronous call to a remote resource, but there is no timeout for the call, or the timeout is set to infinite.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qmcv-hh7c-3m56 H2O-3 is Vulnerable to Code Injection | Critical | Also affects ai.h2o:h2o-core |
| GHSA-wj3h-wx8g-x699 H2O has an External Control of File Name or Path vulnerability | Critical | Also affects ai.h2o:h2o-core |
| GHSA-5w3j-gwgh-4rfv H2O affected by a deserialization vulnerability | Critical | Also affects ai.h2o:h2o-core |
| GHSA-g48v-3p35-88jr H2O Vulnerable to Arbitrary File Overwrite | High | Also affects ai.h2o:h2o-core |
| GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint | High | Also affects ai.h2o:h2o-core |
| GHSA-6w62-3jvj-mfj6 H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing | High | Also affects ai.h2o:h2o-core |
| GHSA-m37h-8r48-2cxj H2O Vulnerable to Execution of Arbitrary Files | Medium | Also affects ai.h2o:h2o-core |
| GHSA-47f6-5p7h-5f3h H2O Vulnerable to Arbitrary File Overwrite via File Export | High | Also affects ai.h2o:h2o-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor