CVE-2024-10550 — Denial of Service by ReDOS in h2oai/h2o-3

Back Back to CVE browser

HIGH

Denial of Service by ReDOS in h2oai/h2o-3

Published Mar 20, 2025

7.5

HIGH

CVSS 3.0

EPSS 0.62%

Description

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

Affected products

Vendor H2oai Product H2oai/h2o-3 Default
n/a
- Version
  unspecified
  Status
  affected
  Constraints
  <=latest

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

H2oai

H2oai/h2o-3

n/a

Version	Status	Constraints
unspecified	affected	<=latest

Remediation

No remediation recorded yet.

Metrics

0.62% 0.00624

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00624

Score over time

2025–2026

EPSS v4
EPSS v5

Percentile over time

EPSS v4
EPSS v5

Table of values (3 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.62% (0.00624)	48.10th	v5 (v2026.06.15)
Jun 15, 2026	0.55% (0.00547)	41.31th	v5 (v2026.06.15)
Mar 20, 2025	0.04% (0.00043)	10.10th	v4 (v2025.03.14)

Weaknesses (1)

CWE-1333

References (4)

Link	Providers	Tags
https://github.com/advisories/GHSA-7qq7-pvm9-x8rf		Advisory
https://github.com/h2oai/h2o-3/blob/51c25940ded8b7d0acc8f3f72329fd9dedbb3a34/h2o-core/src/main/java/water/api/ParseSetupHandler.java#L121
https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6		ExploitThird Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-10550