CVE-2024-7765 HIGH

CVE-2024-7765: Denial of Service in h2oai/h2o-3

Vendor H2Oai
Product h2oai/h2o-3
Weakness CWE-409
Published March 20, 2025
Last update March 20, 2025

CVSS base score

7.5/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality None
Integrity None

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What the vulnerability does

01Description

In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.

Key dates

02Disclosure timeline

March 20, 2025 CVE published
March 20, 2025 Record updated