CVE-2024-7765
Published: 20 March 2025
Description
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
Security Summary
CVE-2024-7765 affects h2oai/h2o-3 version 3.46.0.2 and involves a denial-of-service vulnerability triggered by uploading and repeatedly parsing a large GZIP file. This improper handling of highly compressed data causes significant data amplification, leading to memory exhaustion and a surge in concurrent slow-running jobs that render the server unresponsive. The issue is classified under CWE-409 with a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H).
Unauthenticated remote attackers can exploit this vulnerability with low complexity over the network. By supplying a malicious large GZIP file for repeated parsing, they trigger excessive resource consumption, resulting in denial of service through server unresponsiveness.
Mitigation details are available in the referenced advisory at https://huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
The vulnerability enables remote exploitation of the application to trigger resource exhaustion and denial of service via malicious compressed file input.