GHSA-7qq7-pvm9-x8rf
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| PyPI | h2o | >= 3.30.0.7, <= 3.46.0.1 | no fix listed |
| Maven | ai.h2o:h2o-core | >= 3.30.0.7, <= 3.46.0.1 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
References
External links from the advisory. They lead to third-party sites.