TI-2024-07202 Aliases CVE-2024-7768 GHSA-p2vc-m5fv-9w9m

Denial of Service in h2oai/h2o-3

HIGH 72CWE-770Published 2025-03-20 · Updated 2025-10-15

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Denial of service
Confidentiality · integrity · availability: None · None · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-770.

Summary

A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00788 56th percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: Yes
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
h2oai	h2oai/h2o-3	up to latest	—	No fix listed	CNA
—	h2o (PyPI)	up to 3.46.1	—	No fix listed	GHSA-p2vc-m5fv-9w9m
—	ai.h2o:h2o-core (Maven)	up to 3.46.1	—	No fix listed	GHSA-p2vc-m5fv-9w9m

h2oai/h2o-3 Vendorh2oai Affected up to latest Fixed in — No fix listed CNA
h2o (PyPI) Vendor— Affected up to 3.46.1 Fixed in — No fix listed GHSA-p2vc-m5fv-9w9m
ai.h2o:h2o-core (Maven) Vendor— Affected up to 3.46.1 Fixed in — No fix listed GHSA-p2vc-m5fv-9w9m

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:h2o:h2o:3.46.1:::::::*	3.46.1	Vulnerable	h2oai

cpe:2.3:a:h2o:h2o:3.46.1:*:*:*:*:*:*:* Versions 3.46.1 Vulnerable ·h2oai

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-7768
2026-10-03 Alias added: GHSA-p2vc-m5fv-9w9m

References

Exploit 1

https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-7768

Other 2

TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8
TI-2024-07992 Arbitrary File Overwrite in h2oai/h2o-3 CVSS 3.0HIGH 8.2
TI-2023-06020 External Control of File Name or Path in h2oai/h2o-3 CVSS 3.1HIGH 8.2

See all 29 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences