Skip to main content

Inefficient Regular Expression Complexity

CVE-2024-10550

High
7.5/10

Summary

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3, allows for a Denial of Service (Dos) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive. This issue affects both Maven-ai.h2o:h2o-core, and Pypi-h2o packages versions 3.30.0.7 and after.

  • LOW
  • NETWORK
  • NONE
  • UNCHANGED
  • NONE
  • NONE
  • NONE
  • HIGH

CWE-1333 - Inefficient Regular Expression Complexity

The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles.

References

Advisory Timeline

  • Published