CVE-2024-10550
Denial of Service by ReDOS in h2oai/h2o-3
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Denial of Service by ReDOS in h2oai/h2o-3
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
Reserved 2024-10-30 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_aiCWE-1333 Inefficient Regular Expression Complexity
huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6
Support options
