Skip to content
Fencer Vulns
high 7.5

CVE-2024-10549 json

Denial of Service by ReDOS in h2oai/h2o-3

published 2025-03-20 19 mo ago modified 2026-07-07 4 mo ago also GHSA-wwr9-4gmr-xvq9 , PYSEC-2026-1445 , EUVD-2025-7097

cvss
7.5
version 3.0, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.6%
EPSS 0.6% chance of exploitation in 30 days, percentile 50%
public exploits
0
none known

Summary

A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

0.64% chance of exploitation in the next 30 days, higher than 50% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • huntr.com https://huntr.com/bounties/ce7bd2d6-fd38-440d-a91a-dd8f3fc06bc2 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.0 7.5 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
pypi h2o
>=3.30.0.7, <=3.46.0.1
 no fix listed
maven ai.h2o:h2o-core
>=3.30.0.7, <=3.46.0.1
 no fix listed

Affected products

  • h2oai h2oai/h2o-3

Classification

Weakness
  • CWE-1333 Inefficient Regular Expression Complexity
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.