Analysis
Analysis and contextual insights are available on OpenCVE Cloud.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| h2oai | h2oai/h2o-3 | affected |
|
No data.
No data available yet.
No vendor fix or workaround currently provided.
Additional remediation guidance may be available on OpenCVE Cloud.
Tracking
Sign in to view the affected projects.
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2025-7097 | A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service. |
 Github GHSA |
GHSA-wwr9-4gmr-xvq9 | H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint |
Wed, 15 Oct 2025 13:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-400 |
Wed, 15 Oct 2025 13:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Weaknesses | CWE-1333 |
Mon, 14 Jul 2025 14:00:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| First Time appeared |
H2o
H2o h2o |
|
| CPEs | cpe:2.3:a:h2o:h2o:3.46.0.1:*:*:*:*:*:*:* | |
| Vendors & Products |
H2o
H2o h2o |
Thu, 20 Mar 2025 14:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 20 Mar 2025 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service. | |
| Title | Denial of Service by ReDOS in h2oai/h2o-3 | |
| Weaknesses | CWE-400 | |
| References |
| |
| Metrics |
cvssV3_0
|
MITRE
Status: PUBLISHED
Assigner: @huntr_ai
Published:
Updated: 2025-10-15T12:49:27.711Z
Reserved: 2024-10-30T16:35:38.176Z
Link: CVE-2024-10549
Vulnrichment
Updated: 2025-03-20T14:05:28.968Z
NVD
Status : Modified
Published: 2025-03-20T10:15:17.263
Modified: 2025-10-15T13:15:35.860
Link: CVE-2024-10549
Redhat
No data.
OpenCVE Enrichment
No data.