CVE-2024-10550 HIGH

CVE-2024-10550: Denial of Service by ReDOS in h2oai/h2o-3

Vendor H2Oai

Product h2oai/h2o-3

Weakness CWE-1333

Published March 20, 2025

Last update March 20, 2025

View on NVD All CVEs

CVSS base score

7.5/10

Attack vector Network

Attack complexity Low

Privileges required None

User interaction None

Confidentiality None

Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

Key dates

02Disclosure timeline

March 20, 2025 CVE published

March 20, 2025 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-10550 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/1333.html

Related vulnerabilities

04Related CVE

CVE-2026-28356 ReDoS in multipart 1.3.0 - `parse_options_header()` CVE-2026-4923 path-to-regexp vulnerable to Regular Expression Denial of Service via multiple wildcards CVE-2026-27904 minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions CVE-2026-23897 Apollo Server is vulnerable to denial of service with `startStandaloneServer` CVE-2026-3293 snowflakedb snowflake-jdbc JDBC URL SdkProxyRoutePlanner.java SdkProxyRoutePlanner redos