CVE-2024-10550

N/A

Description

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

CVE Details

CVSS v3.1 ScoreN/A

Published3/20/2025

Last Modified7/14/2025

Sourcenvd

Honeypot Sightings0

Affected Products

h2o:h2o

Weaknesses (CWE)

CWE-1333

References

https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6(security@huntr.dev)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.