CVE-2024-7765: Denial of Service in h2oai/h2o-3
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-7765?
CVE-2024-7765 has a high severity level due to its potential to cause denial of service.
How do I fix CVE-2024-7765?
To fix CVE-2024-7765, upgrade to a version of H2O-3 later than 3.46.0.2.
What type of attack does CVE-2024-7765 enable?
CVE-2024-7765 enables a denial of service attack by exhausting server memory through large GZIP file uploads.
Which versions of H2O-3 are affected by CVE-2024-7765?
CVE-2024-7765 affects H2O-3 versions from 3.32.1.2 to 3.46.0.2 inclusive.
What happens when CVE-2024-7765 is exploited?
When CVE-2024-7765 is exploited, the server becomes unresponsive due to memory exhaustion and slow-running jobs.