GHSA-7qq7-pvm9-x8rf CVE-2024-10550 PYSEC-2026-1440
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
- Severity
- 7.5 / 10
- High · CVSS 3.0
- Exploit chance (EPSS)
- 0.64%
- Chance of exploitation in the next 30 days. Higher than 50.52% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-1333 Inefficient Regular Expression Complexity
- Fix
- None yet
- No fixed version published
Description
A vulnerability in the /3/ParseSetup endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| ai.h2o:h2o-core | >= 3.30.0.7, <= 3.46.0.1 |
No fix yet |
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| h2o | >= 3.30.0.7, <= 3.46.0.1 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.0 7.5
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Weakness
CWE-1333: Inefficient Regular Expression Complexity
The product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential.
How to prevent it
- Architecture and Design: Use regular expressions that do not support backtracking, e.g. by removing nested quantifiers.
- System Configuration: Set backtracking limits in the configuration of the regular expression implementation, such as PHP's pcre.backtrack_limit. Also consider limits on execution time for the process.
- Implementation: Do not use regular expressions with untrusted input. If regular expressions must be used, avoid using backtracking in the expression.
- Implementation: Limit the length of the input that the regular expression will process.
References
Advisories
Packages
Other links
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-qmcv-hh7c-3m56 H2O-3 is Vulnerable to Code Injection | Critical | Also affects ai.h2o:h2o-core |
| GHSA-wj3h-wx8g-x699 H2O has an External Control of File Name or Path vulnerability | Critical | Also affects ai.h2o:h2o-core |
| GHSA-5w3j-gwgh-4rfv H2O affected by a deserialization vulnerability | Critical | Also affects ai.h2o:h2o-core |
| GHSA-g48v-3p35-88jr H2O Vulnerable to Arbitrary File Overwrite | High | Also affects ai.h2o:h2o-core |
| GHSA-5c8j-g96x-cj78 H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request | High | Also affects ai.h2o:h2o-core |
| GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint | High | Also affects ai.h2o:h2o-core |
| GHSA-6w62-3jvj-mfj6 H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing | High | Also affects ai.h2o:h2o-core |
| GHSA-m37h-8r48-2cxj H2O Vulnerable to Execution of Arbitrary Files | Medium | Also affects ai.h2o:h2o-core |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor