CVE-2024-5979 HIGH

CVE-2024-5979: Denial of Service via Invalid Argument in h2oai/h2o-3

Vendor H2Oai
Product h2oai/h2o-3
Weakness CWE-94 · Code injection
Published June 27, 2024
Last update October 15, 2025
View on NVD All CVEs

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.

Key dates

02Disclosure timeline

June 27, 2024 CVE published
October 15, 2025 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-8832 WPCode <= 2.3.5 - Authenticated (Author+) Remote Code Execution via CPT Capability Bypass via XML-RPC wp.newPost CVE-2025-24677 WordPress Post/Page Copying Tool to Export and Import post/page for Cross site Migration Plugin <= 2.0.3 - Remote Code Execution (RCE) vulnerability CVE-2025-8417 Catalog Importer, Scraper & Crawler <= 5.1.4 - Unauthenticated PHP Code Injection CVE-2024-25706 HTMLi at createFolder Content Injection CVE-2026-9568 ThingsBoard YAML provision getGatewayDockerComposeFile code injection