CVE-2024-10550: Denial of Service by ReDOS in h2oai/h2o-3
A vulnerability in the /3/ParseSetup endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-10550?
CVE-2024-10550 has a severity rating that indicates it can be exploited for a denial of service (DoS) attack.
What software versions are affected by CVE-2024-10550?
CVE-2024-10550 affects H2O-3 versions from 3.30.0.7 up to 3.46.0.1.
How can I mitigate the risks of CVE-2024-10550?
To mitigate CVE-2024-10550, upgrade to a version of H2O-3 that is not vulnerable, typically beyond 3.46.0.1.
What type of attack does CVE-2024-10550 enable?
CVE-2024-10550 enables a denial of service (DoS) attack through the exploitation of the `/3/ParseSetup` endpoint.
Where in the code can I find the issue related to CVE-2024-10550?
The issue related to CVE-2024-10550 can be found in the code for the `/3/ParseSetup` endpoint in the H2O-3 project.