CVE-2024-10550

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-10550
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

7.5 /10

CVSS v3 : HIGH

V3 Legend

Vector : AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

cpe:2.3:a:h2o:h2o:3.46.0.1:*:*:*:*:*:*:*
History

14 Jul 2025, 13:49

Type Values Removed Values Added
CPE cpe:2.3:a:h2o:h2o:3.46.0.1:*:*:*:*:*:*:*
References () https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6 - () https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6 - Exploit, Third Party Advisory
First Time H2o h2o
H2o
Summary
  • (es) Una vulnerabilidad en el endpoint `/3/ParseSetup` de h2oai/h2o-3 versión 3.46.0.1 permite un ataque de denegación de servicio (DoS). El endpoint aplica una expresión regular especificada por el usuario a una cadena controlable por este. Un atacante puede explotar esto para generar una complejidad ineficiente en las expresiones regulares, agotando los recursos del servidor y dejándolo inoperante.

20 Mar 2025, 10:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-20 10:15

Updated : 2025-07-14 13:49

NVD link : CVE-2024-10550

Mitre link : CVE-2024-10550

CVE.ORG link : CVE-2024-10550

JSON object : View

Products Affected

h2o

  • h2o
CWE
CWE-1333

Inefficient Regular Expression Complexity