CVE-2024-8062

Description

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.

CVSS v3.1 Score

7.5

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness Type (CWE)

CWE-1088 CWE-1088

Affected Products

Vendor	Product	Versions
h2o	h2o	All

References

Exploits

https://huntr.com/bounties/a04190d9-4acb-449a-9a7f-f1bf6be1ed23 https://huntr.com/bounties/a04190d9-4acb-449a-9a7f-f1bf6be1ed23

Frequently Asked Questions

What is CVE-2024-8062? +

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests. It has a CVSS v3.1 base score of 7.5 (HIGH).

How severe is CVE-2024-8062? +

CVE-2024-8062 has a CVSS v3.1 score of 7.5 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-8062? +

CVE-2024-8062 affects products from h2o, specifically: h2o. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-8062? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-8061 7.5

In version 3.23.0 of aimhubio/aim, certain methods that request data from external servers do not have set timeouts, causing the …

CVE-2024-12777 5.9

A vulnerability in aimhubio/aim version 3.25.0 allows for a denial of service through the misuse of the sshfs-client. The tracking …

CVE-2025-4656 3.1

Vault Community and Vault Enterprise rekey and recovery key operations can lead to a denial of service due to uncontrolled …

CVE-2024-10553 9.8

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of …

CVE-2025-6544 9.8

A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. …

CVE-2024-45758 9.1

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command …