CVE-2024-10550CWE-1333

Denial of Service by ReDOS in h2oai/h2o-3

High · published March 20, 2025

CVSS v3.0
7.5
EPSS
1%
Percentile
49.9
In the wild
Unconfirmed
What it is

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

The record
Technical detail
CVSS v3.0
7.5 · HIGH
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00637 · 49.9th percentile
Weakness
CWE-1333 · Inefficient Regular Expression Complexity
Published
2025-03-20T10:10Z
EPSS history
Timeline
  • 20 MAR 10:10Z
    Denial of Service by ReDOS in h2oai/h2o-3
    cvelistv5