High severity · published Mar 20, 2025
CVE-2024-7768
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service
7.5
CVSS
0.8%
EPSS
No
On KEV
Description
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
H2o · H2o
3.46.1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-7768
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-7768
Exploit
https://huntr.com/bounties/3fe640df-bef4-4072-8890-0d12bc2818f6
More from H2o
9.8
CVE-2026-8751
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
9.8
CVE-2026-3960
Remote Code Execution in h2oai/h2o-3
9.8
CVE-2025-10769
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
9.8
CVE-2025-10768
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
9.8
CVE-2025-6544
Deserialization Vulnerability in h2oai/h2o-3