CVE-2024-7765: H2o H2o GZIP Parsing DoS Vulnerability

CVE-2024-7765 Overview

CVE-2024-7765 is a denial of service vulnerability in h2oai/h2o-3 version 3.46.0.2. The flaw allows unauthenticated network attackers to exhaust server memory by uploading and repeatedly parsing a large GZIP file. The server becomes unresponsive due to memory exhaustion and a backlog of concurrent slow-running jobs. The root cause is improper handling of highly compressed input, which produces significant data amplification during decompression. The issue is classified under [CWE-409] (Improper Handling of Highly Compressed Data / Data Amplification).

Critical Impact
An unauthenticated attacker can render an H2O-3 machine learning server unavailable by submitting crafted GZIP files that amplify into far larger in-memory payloads.

Affected Products

H2O h2o-3 version 3.46.0.2
Deployments exposing the H2O REST API for file upload and parsing
Machine learning pipelines relying on H2O-3 for automated data ingestion

Discovery Timeline

2025-03-20 - CVE-2024-7765 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7765

Vulnerability Analysis

H2O-3 exposes a parsing endpoint that accepts compressed input, including GZIP archives. When a highly compressed file is uploaded, the server decompresses and parses it in memory as part of a job. The parser does not enforce effective limits on the decompressed size or on the number of concurrent parse jobs a client can queue. Repeated submissions of the same small GZIP file therefore expand into gigabytes of resident memory and spawn multiple long-running jobs in parallel. The service ultimately stops responding to legitimate requests once memory and worker capacity are consumed.

Root Cause

The underlying weakness is a data amplification defect [CWE-409]. The parser trusts client-supplied compressed input without bounding the ratio between compressed and decompressed size. Combined with the absence of per-client job throttling, this produces an asymmetric resource cost: attackers spend minimal bandwidth while the server allocates disproportionate memory and compute.

Attack Vector

Exploitation requires only network access to the H2O-3 API and no authentication or user interaction. An attacker uploads a small GZIP file crafted to expand to a very large payload, then invokes the parse operation repeatedly. Each invocation launches a new slow job, and the concurrent jobs collectively exhaust the JVM heap and worker threads. Additional exploitation details are available in the Huntr Bounty Listing.

Detection Methods for CVE-2024-7765

Indicators of Compromise

Repeated POST requests to H2O-3 parse or import endpoints from a single source within a short window.
Uploads of small GZIP files followed by parse jobs that consume disproportionate memory.
Rapid growth of the H2O JVM heap and a spike in concurrent job identifiers reported by the H2O cluster status API.
Health probes to /3/Cloud or /3/Jobs timing out while the process remains running.

Detection Strategies

Monitor the compressed-to-decompressed size ratio of files submitted to H2O-3 and alert when the ratio exceeds a defined threshold.
Track the number of active parse jobs per source IP and flag bursts that exceed normal ingestion patterns.
Correlate H2O application logs with host-level memory pressure and JVM garbage collection events.

Monitoring Recommendations

Enable request logging on any reverse proxy fronting H2O-3 to capture upload sizes, source addresses, and endpoint paths.
Export JVM memory, thread count, and job queue depth metrics to a centralized monitoring platform.
Alert on sustained CPU or memory saturation on H2O nodes, particularly when correlated with inbound uploads.

How to Mitigate CVE-2024-7765

Immediate Actions Required

Restrict network access to H2O-3 endpoints so that only trusted clients can reach the parse and import APIs.
Place H2O-3 behind an authenticating reverse proxy that enforces request size limits and per-client rate limits.
Cap the maximum upload size and reject GZIP payloads whose declared or observed expansion ratio exceeds a safe bound.
Audit exposed H2O-3 instances for version 3.46.0.2 and identify any that are reachable from untrusted networks.

Patch Information

No vendor patch is referenced in the NVD entry at the time of publication. Consult the Huntr Bounty Listing and the H2O project release notes for updated versions beyond 3.46.0.2 before deploying to production.

Workarounds

Disable anonymous access to the H2O-3 API and require authentication at the proxy layer.
Limit the number of concurrent parse jobs per user or per source IP using proxy-level concurrency controls.
Reject GZIP uploads at the proxy when the file is smaller than a configured threshold but declares an unusually large decompressed size.
Run H2O-3 with a bounded JVM heap and container memory limits so that resource exhaustion terminates the workload rather than the host.

bash

# Example NGINX reverse proxy controls in front of H2O-3
http {
    limit_req_zone $binary_remote_addr zone=h2o_parse:10m rate=5r/m;
    client_max_body_size 25m;

    server {
        listen 443 ssl;
        server_name h2o.internal.example.com;

        location /3/PostFile {
            limit_req zone=h2o_parse burst=2 nodelay;
            auth_basic "H2O-3";
            auth_basic_user_file /etc/nginx/h2o.htpasswd;
            proxy_pass http://127.0.0.1:54321;
        }

        location /3/Parse {
            limit_req zone=h2o_parse burst=2 nodelay;
            auth_basic "H2O-3";
            auth_basic_user_file /etc/nginx/h2o.htpasswd;
            proxy_pass http://127.0.0.1:54321;
        }
    }
}