CVE-2024-10549: Denial of Service by ReDOS in h2oai/h2o-3
A vulnerability in the /3/Parse endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10549?
CVE-2024-10549 is considered a high-severity vulnerability due to its potential for causing denial of service (DoS) attacks.
How do I fix CVE-2024-10549?
To fix CVE-2024-10549, update to the latest version of h2oai/h2o-3 that addresses this vulnerability.
What is the impact of CVE-2024-10549?
CVE-2024-10549 can lead to denial of service, making the application unresponsive to legitimate requests.
Which versions of H2O-3 are affected by CVE-2024-10549?
CVE-2024-10549 affects H2O-3 version 3.46.0.1 and potentially earlier versions.
How does CVE-2024-10549 allow for a denial of service?
CVE-2024-10549 allows a denial of service by exploiting the `/3/Parse` endpoint, which improperly handles user-specified strings for regular expression construction.