CVE-2024-7768: Denial of Service in h2oai/h2o-3
A vulnerability in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, path, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7768?
CVE-2024-7768 has a severity rating that indicates it may lead to a denial of service attack.
How do I fix CVE-2024-7768?
To fix CVE-2024-7768, you should upgrade to a patched version of h2oai/h2o-3 that resolves this vulnerability.
What type of attack does CVE-2024-7768 enable?
CVE-2024-7768 enables a denial of service attack due to recursive calls to the `/3/ImportFiles` endpoint.
Which software versions are affected by CVE-2024-7768?
CVE-2024-7768 affects h2oai/h2o-3 version 3.46.1 and possibly earlier versions.
Can CVE-2024-7768 be exploited remotely?
Yes, CVE-2024-7768 can be exploited remotely since it involves a publicly accessible endpoint.