CVE-2024-10550: H2O H2O Denial of Service Vulnerability

CVE-2024-10550 Overview

CVE-2024-10550 is a denial of service (DoS) vulnerability in the /3/ParseSetup endpoint of h2oai/h2o-3 version 3.46.0.1. The endpoint applies a user-supplied regular expression to a user-controllable input string. An unauthenticated remote attacker can submit a crafted regex pattern that triggers catastrophic backtracking, consuming excessive CPU cycles. This algorithmic complexity attack exhausts server resources and renders the h2o-3 instance unresponsive to legitimate requests. The vulnerability is tracked under CWE-1333: Inefficient Regular Expression Complexity.

Critical Impact
Unauthenticated attackers can remotely exhaust CPU resources on h2o-3 servers, making machine learning workloads and API services unavailable.

Affected Products

h2oai/h2o-3 version 3.46.0.1
The /3/ParseSetup REST API endpoint
Deployments exposing the h2o-3 REST interface to untrusted networks

Discovery Timeline

2025-03-20 - CVE-2024-10550 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-10550

Vulnerability Analysis

The /3/ParseSetup endpoint accepts two attacker-controlled inputs: a regular expression pattern and a target string to evaluate against that pattern. The server executes the regex match without complexity limits, timeouts, or safe-regex validation. An attacker can craft a pathological expression, such as a nested quantifier pattern applied to a long input, that produces exponential backtracking in the Java regex engine. A single HTTP request is sufficient to pin a CPU core, and a small number of parallel requests can saturate the entire server.

The attack requires no authentication, no user interaction, and can be delivered over the network. h2o-3 is typically deployed as a long-running service for machine learning workflows, so resource exhaustion directly disrupts model training, scoring, and data ingestion pipelines. The EPSS score is 0.588% at the 43.87 percentile as of 2026-07-07.

Root Cause

The root cause is unsanitized regex evaluation. The endpoint treats user input as a trusted pattern and passes it directly to the underlying regex engine. There is no allowlist of safe patterns, no complexity analysis, no execution timeout, and no throttling on parse setup requests.

Attack Vector

Exploitation is performed by sending an HTTP POST request to /3/ParseSetup on an exposed h2o-3 instance. The attacker supplies a regex pattern known to cause exponential backtracking, paired with a crafted string that maximizes the backtracking path. The server thread blocks on regex evaluation until the request is aborted or the process is terminated. Refer to the Huntr Bug Bounty Report for the disclosed technical details.

Detection Methods for CVE-2024-10550

Indicators of Compromise

Sustained CPU utilization at or near 100% on one or more h2o-3 JVM threads with no legitimate workload running
HTTP POST requests to /3/ParseSetup from untrusted sources, especially with unusually long or nested regex parameters
h2o-3 API becoming unresponsive or timing out under low external traffic
Java thread dumps showing threads blocked inside java.util.regex.Pattern$* matcher frames

Detection Strategies

Instrument the h2o-3 reverse proxy to log request bodies and query parameters for /3/ParseSetup calls
Alert on regex parameters containing nested quantifiers such as (a+)+, (.*)*, or long alternations
Monitor JVM CPU time per request and flag any single /3/ParseSetup invocation exceeding a defined threshold

Monitoring Recommendations

Enable access logging on the h2o-3 REST API and forward logs to a centralized SIEM for correlation
Track request-per-second and average response time baselines for /3/ParseSetup to detect anomalies
Configure JVM monitoring to capture thread stack traces when CPU saturation is detected

How to Mitigate CVE-2024-10550

Immediate Actions Required

Restrict network access to the h2o-3 REST API using firewall rules, VPN, or an authenticated reverse proxy
Block or rate-limit unauthenticated requests to /3/ParseSetup at the network edge
Audit exposed h2o-3 instances for internet reachability and remove unnecessary public exposure

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-10550 at the time of publication. Monitor the h2oai/h2o-3 GitHub repository and the Huntr Bug Bounty Report for fixed versions beyond 3.46.0.1, and upgrade once a patched release is available.

Workarounds

Place h2o-3 behind an authenticating reverse proxy such as NGINX or an API gateway that enforces access control
Deploy a web application firewall rule that rejects requests to /3/ParseSetup containing regex metacharacter patterns known to cause catastrophic backtracking
Apply CPU and memory cgroup limits to the h2o-3 process to contain the impact of a single malicious request
Enforce request timeouts at the proxy layer so long-running regex evaluations are terminated before exhausting server capacity

bash

# Example NGINX configuration restricting and rate-limiting the ParseSetup endpoint
limit_req_zone $binary_remote_addr zone=parsesetup:10m rate=5r/m;

location /3/ParseSetup {
    limit_req zone=parsesetup burst=2 nodelay;
    allow 10.0.0.0/8;
    deny all;
    proxy_read_timeout 5s;
    proxy_pass http://h2o_backend;
}