CVE-2024-10549: H2O H2O-3 Denial of Service Vulnerability

CVE-2024-10549 Overview

CVE-2024-10549 is a denial of service vulnerability affecting the /3/Parse endpoint in h2oai/h2o-3 version 3.46.0.1. The endpoint constructs a regular expression from a user-supplied string and applies it to another user-supplied string. This design enables Regular Expression Denial of Service (ReDoS) conditions [CWE-1333]. Attackers can send multiple simultaneous requests with crafted patterns to exhaust all available server threads. The result is a complete denial of service of the h2o-3 machine learning platform. The vulnerability requires no authentication and is exploitable over the network.

Critical Impact
Unauthenticated attackers can exhaust server threads and render the h2o-3 machine learning service unavailable through catastrophic backtracking in regular expression processing.

Affected Products

h2oai/h2o-3 version 3.46.0.1
H2O machine learning platform instances exposing the /3/Parse REST endpoint
Deployments where the h2o-3 API is reachable over the network

Discovery Timeline

2025-03-20 - CVE-2024-10549 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10549

Vulnerability Analysis

The /3/Parse endpoint in h2o-3 accepts user-controlled input to build a regular expression at runtime. It then evaluates that regular expression against additional user-controlled text. This pattern is the textbook ReDoS scenario categorized under [CWE-1333] Inefficient Regular Expression Complexity.

An attacker who submits a pattern with nested quantifiers or overlapping alternations forces the regex engine into catastrophic backtracking. Each malicious request consumes a worker thread for an extended period. Sending several requests in parallel exhausts the thread pool serving the h2o-3 REST API.

Once the pool is saturated, legitimate parse jobs, model training calls, and other API operations queue indefinitely or fail. The service becomes unresponsive without any authentication step or user interaction. Recovery typically requires an operator to restart the h2o-3 process.

Root Cause

The root cause is unsafe construction of regular expressions from untrusted input combined with the absence of execution timeouts. The endpoint neither validates the complexity of the supplied pattern nor bounds the CPU time available to a single regex evaluation. Any input that produces exponential-time matching directly translates into thread starvation on the server.

Attack Vector

The attack vector is remote and unauthenticated over the h2o-3 REST API. An attacker sends HTTP requests to /3/Parse supplying a malicious regex pattern such as one containing nested quantifiers applied to a long non-matching input string. Repeating the request across multiple concurrent connections locks up every worker thread that services the API. No specific network position beyond reachability to the h2o-3 listener is required.

No verified public proof-of-concept code is available. Refer to the Huntr Bug Bounty Report for the researcher's technical writeup.

Detection Methods for CVE-2024-10549

Indicators of Compromise

Sustained high CPU utilization on the h2o-3 JVM process without a corresponding increase in completed jobs.
Multiple concurrent HTTP requests targeting /3/Parse from a single source or small set of sources.
Long-running or hung requests to /3/Parse visible in access logs with no response returned.
Thread pool saturation warnings or request queue backlogs in the h2o-3 server logs.

Detection Strategies

Inspect HTTP request bodies to /3/Parse for regex patterns containing nested quantifiers such as (a+)+, (.*)*, or long alternation chains.
Correlate spikes in per-request latency for /3/Parse with concurrent request counts to identify ReDoS attempts.
Deploy a reverse proxy or WAF rule that flags unusually large or complex regex payloads submitted to h2o-3 API paths.

Monitoring Recommendations

Track thread pool utilization and request queue depth of the h2o-3 REST server as first-class metrics.
Alert on repeated client requests that exceed a defined execution-time threshold at the /3/Parse endpoint.
Retain HTTP access logs and JVM thread dumps to support forensic review after suspected DoS events.

How to Mitigate CVE-2024-10549

Immediate Actions Required

Restrict network access to the h2o-3 API so only trusted analytics clients can reach /3/Parse.
Place h2o-3 behind an authenticating reverse proxy and enforce rate limits per source IP address.
Add a WAF policy that blocks requests to /3/Parse containing high-risk regex constructs.

Patch Information

No vendor advisory or fixed version is referenced in the NVD entry for CVE-2024-10549 at the time of publication. Monitor the Huntr Bug Bounty Report and the h2oai/h2o-3 project repository for a patched release, and upgrade as soon as a fix beyond 3.46.0.1 becomes available.

Workarounds

Disable or gate the /3/Parse endpoint at the network layer if it is not required for production workflows.
Enforce request timeouts at the reverse proxy so long-running regex evaluations are terminated before exhausting threads.
Cap the size of request bodies accepted by the h2o-3 API to reduce the input surface available for ReDoS payloads.
Run h2o-3 instances in isolated environments so a DoS on one instance does not affect other analytics workloads.

bash

# Example nginx reverse proxy hardening for h2o-3
location /3/Parse {
    limit_req zone=h2o_parse burst=5 nodelay;
    client_max_body_size 64k;
    proxy_read_timeout 10s;
    proxy_send_timeout 10s;
    proxy_pass http://h2o_backend;
}