Home » Database

AVID-2026-R1368

Description

Denial of Service by ReDOS in h2oai/h2o-3 (CVE-2024-10549)

Details

A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.

Reason for inclusion in AVID: CVE-2024-10549 describes a Denial of Service vulnerability in h2o-3 (an AI/ML framework) via inefficient regular expression handling in a Parse endpoint. h2o-3 is a software component used in building, training, deploying, and serving AI models, making it a software supply-chain element for general-purpose AI systems. The vulnerability affects availability and is network-exploitable, with CVSS 3.0 high severity. Evidence provided includes the CVE entry, affected artifact, and CWE.

References

Affected or Relevant Artifacts

  • Developer: h2oai
  • Deployer: h2oai
  • Artifact Details:
TypeName
Systemh2oai/h2o-3

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score7.5
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability Impact🔴 High

CWE

IDDescription
CWE-1333CWE-1333 Inefficient Regular Expression Complexity

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry