Home » Database

AVID-2026-R1369

Description

Denial of Service by ReDOS in h2oai/h2o-3 (CVE-2024-10550)

Details

A vulnerability in the /3/ParseSetup endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

Reason for inclusion in AVID: CVE-2024-10550 describes a Denial of Service due to inefficient regex processing in h2o-3, an AI/ML framework. This is a software vulnerability affecting a component (h2o-3) used to build/run AI systems, with potential impact on AI pipelines and deployments. It fits the software supply chain context for general-purpose AI systems and is evidenced by the CVE entry and description.

References

Affected or Relevant Artifacts

  • Developer: h2oai
  • Deployer: h2oai
  • Artifact Details:
TypeName
Systemh2oai/h2o-3

Impact

AVID Taxonomy Categorization

  • Risk domains: Security
  • SEP subcategories: S0100: Software Vulnerability
  • Lifecycle stages: L06: Deployment

CVSS

Version3.0
Vector StringCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Base Score7.5
Base Severity🔴 High
Attack VectorNETWORK
Attack Complexity🟢 Low
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability Impact🔴 High

CWE

IDDescription
CWE-1333CWE-1333 Inefficient Regular Expression Complexity

Other information

  • Report Type: Advisory
  • Credits:
  • Date Reported: 2025-03-20
  • Version: 0.3.3
  • AVID Entry