AIKIDO-2024-10415
h2o is vulnerable to Uncontrolled Resource Consumption
82
High Risk
This Affects:
h2oTL;DR
Affected versions of this package are vulnerable to uncontrolled resource consumption, which could lead to a Denial of Service (DoS). The run_tool command in the rapids component allows the main function of any class under the water.tools namespace to be called. Specifically, when the MojoConvertTool class is invoked with an invalid argument, it causes the server to crash, potentially resulting in resource exhaustion or disruption of service.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range.
Background info
h2o is vulnerable to Uncontrolled Resource Consumption in versions 3.10.0.3 - 3.46.0.5.
How to fix this
Upgrade the h2o library to the patch version.
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
SOC 2Compliant
ISO 27001Compliant