CVE-2024-7768: H2o H2o Denial of Service Vulnerability

CVE-2024-7768 Overview

CVE-2024-7768 is a denial of service vulnerability in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1. The endpoint accepts a single GET parameter, path, which an attacker can recursively set to reference the endpoint itself. This recursion causes the server to repeatedly invoke its own endpoint, saturating the request queue. The h2o-3 server then becomes unable to service legitimate requests. The vulnerability is tracked under [CWE-770: Allocation of Resources Without Limits or Throttling]. The issue was disclosed through a Huntr Bug Bounty Listing.

Critical Impact
Unauthenticated remote attackers can exhaust the h2o-3 request queue with a single crafted GET request, rendering the machine learning platform unavailable to all users.

Affected Products

h2oai/h2o-3 version 3.46.1
H2O machine learning platform deployments exposing the REST API
Any downstream applications or services embedding the affected h2o-3 build

Discovery Timeline

2025-03-20 - CVE-2024-7768 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-7768

Vulnerability Analysis

The /3/ImportFiles REST endpoint in h2o-3 accepts a path GET parameter that specifies the file or URI to import into the H2O cluster. The endpoint does not validate whether the supplied path refers back to the h2o-3 server itself. An attacker can point path at the same /3/ImportFiles endpoint, causing the server to issue a request to itself for each incoming call.

Each recursive request occupies a slot in the server's request-handling queue. Because the recursion is unbounded and the endpoint is unauthenticated, a single external request rapidly consumes all available request handlers. Legitimate API calls, model training jobs, and cluster health checks then time out.

The underlying weakness is classified as [CWE-770], reflecting the absence of a resource allocation limit on recursive or self-referential imports. Confidentiality and integrity are not affected, but availability is fully compromised.

Root Cause

The root cause is missing input validation on the path parameter combined with no throttling on outbound requests initiated by the import routine. The endpoint treats a URL pointing to its own listener as a valid remote source and dispatches a new HTTP request without cycle detection or queue depth limits.

Attack Vector

Exploitation requires network reachability to the h2o-3 API and no authentication or user interaction. An attacker sends a GET request to /3/ImportFiles with the path parameter set to a URL that resolves back to the same /3/ImportFiles endpoint, typically with a recursive path value encoded in the query string. The server begins fetching itself, and each fetch triggers another fetch, consuming worker threads until the request queue is full.

The vulnerability manifests entirely within the ImportFiles request handler. See the Huntr Bug Bounty Listing for the original reporter's technical write-up and proof of concept.

Detection Methods for CVE-2024-7768

Indicators of Compromise

Repeated GET requests to /3/ImportFiles with a path parameter containing the h2o-3 server's own hostname, IP address, or localhost
Rapid growth in the h2o-3 request queue depth accompanied by rising thread counts on the JVM process
HTTP 5xx responses or connection timeouts across all h2o-3 endpoints while the process remains running

Detection Strategies

Inspect web server or reverse proxy logs for /3/ImportFiles requests whose path parameter contains a URL pointing back to the h2o-3 listener
Alert when a single client source produces a burst of /3/ImportFiles requests within a short interval
Correlate spikes in JVM thread counts with inbound API activity on port 54321 or the configured h2o-3 port

Monitoring Recommendations

Ingest h2o-3 access logs into a centralized logging platform and build queries for self-referential path values
Monitor request queue depth, thread pool utilization, and endpoint latency as availability signals
Track outbound HTTP connections from the h2o-3 host to itself as an anomalous pattern warranting review

How to Mitigate CVE-2024-7768

Immediate Actions Required

Restrict network access to the h2o-3 REST API using firewall rules, security groups, or a reverse proxy allowlist
Place the h2o-3 endpoint behind an authenticating proxy so unauthenticated callers cannot reach /3/ImportFiles
Rate-limit requests to /3/ImportFiles at the proxy layer to blunt recursive exploitation attempts

Patch Information

No vendor patch is referenced in the NVD entry for CVE-2024-7768 at the time of publication. Monitor the h2oai/h2o-3 project and the Huntr Bug Bounty Listing for fix availability, and upgrade to a version later than 3.46.1 once a patched release is published.

Workarounds

Block requests to /3/ImportFiles where the path parameter references the h2o-3 host, localhost, or 127.0.0.0/8
Deploy h2o-3 on an internal network segment isolated from untrusted clients and require VPN or mTLS for access
Configure a web application firewall rule to drop ImportFiles requests whose path value contains the server's own scheme and authority

bash

# Example NGINX rule to block self-referential ImportFiles requests
location /3/ImportFiles {
    if ($arg_path ~* "(127\.0\.0\.1|localhost|$host)") {
        return 403;
    }
    limit_req zone=h2o_api burst=5 nodelay;
    proxy_pass http://h2o_backend;
}