GHSA-6w62-3jvj-mfj6 CVE-2024-7765 PYSEC-2026-1439
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.78%
- Chance of exploitation in the next 30 days. Higher than 55.91% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-409 Improper Handling of Highly Compressed Data (Data Amplification)
- Fix
- None yet
- No fixed version published
Description
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| ai.h2o:h2o-core | >= 3.32.1.2, <= 3.46.0.2 |
No fix yet |
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| h2o | >= 3.32.1.2, <= 3.46.0.2 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
The product does not handle or incorrectly handles a compressed input with a very high compression ratio that produces a large output.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qmcv-hh7c-3m56 H2O-3 is Vulnerable to Code Injection | Critical | Also affects ai.h2o:h2o-core |
| GHSA-wj3h-wx8g-x699 H2O has an External Control of File Name or Path vulnerability | Critical | Also affects ai.h2o:h2o-core |
| GHSA-5w3j-gwgh-4rfv H2O affected by a deserialization vulnerability | Critical | Also affects ai.h2o:h2o-core |
| GHSA-g48v-3p35-88jr H2O Vulnerable to Arbitrary File Overwrite | High | Also affects ai.h2o:h2o-core |
| GHSA-5c8j-g96x-cj78 H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request | High | Also affects ai.h2o:h2o-core |
| GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint | High | Also affects ai.h2o:h2o-core |
| GHSA-m37h-8r48-2cxj H2O Vulnerable to Execution of Arbitrary Files | Medium | Also affects ai.h2o:h2o-core |
| GHSA-47f6-5p7h-5f3h H2O Vulnerable to Arbitrary File Overwrite via File Export | High | Also affects ai.h2o:h2o-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor