A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.

Metrics

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00156.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
H2o
  • H2o
H2oai
  • H2o-3

Configuration 1 [-]

cpe:2.3:a:h2o:h2o:3.46.1:*:*:*:*:*:*:*

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
H2oai
  • H2o-3
Advisories
Source ID Title
EUVD EUVD EUVD-2025-6944 A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
Github GHSA Github GHSA GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6 cve-icon cve-icon
History

Wed, 15 Oct 2025 13:30:00 +0000

Type Values Removed Values Added
Weaknesses CWE-400

Wed, 15 Oct 2025 13:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-770

Wed, 16 Jul 2025 13:45:00 +0000

Type Values Removed Values Added
Metrics epss

{'score': 0.00061}

 epss

{'score': 0.00072}

Tue, 15 Jul 2025 16:00:00 +0000

Type Values Removed Values Added
First Time appeared H2o
H2o h2o
CPEs cpe:2.3:a:h2o:h2o:3.46.1:*:*:*:*:*:*:*
Vendors & Products H2o
H2o h2o

Thu, 20 Mar 2025 10:15:00 +0000

Type Values Removed Values Added
Description A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
Title Denial of Service in h2oai/h2o-3
Weaknesses CWE-400
References
Metrics cvssV3_0

{'score': 7.5, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}
cve-icon MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published:

Updated: 2025-10-15T12:49:52.281Z

Reserved: 2024-08-13T18:55:25.587Z

Link: CVE-2024-7768

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Modified

Published: 2025-03-20T10:15:37.133

Modified: 2025-10-15T13:15:52.797

Link: CVE-2024-7768

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2025-07-13T11:32:21Z