CVE-2024-7768

Description

A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.

Reserved 2024-08-13 | Published 2025-03-20 | Updated 2025-03-20 | Assigner @huntr_ai

Problem types

CWE-400 Uncontrolled Resource Consumption

Product status

Any version
affected

References

huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6

cve.org (CVE-2024-7768)

nvd.nist.gov (CVE-2024-7768)

Download JSON