CVE-2024-8062: H2o H2o Denial of Service Vulnerability

CVE-2024-8062 Overview

CVE-2024-8062 is a denial of service vulnerability affecting the typeahead endpoint of h2oai/h2o-3 version 3.46.0. The endpoint issues an outbound HEAD request to verify the existence of a user-specified resource without configuring a timeout. An attacker can direct the application to an attacker-controlled server that never responds, exhausting request-handling capacity. The flaw is tracked under CWE-1088: Synchronous Access of Remote Resource without Timeout.

Critical Impact
Remote unauthenticated attackers can render an H2O instance unresponsive by triggering blocking outbound HEAD requests against a hung server.

Affected Products

h2oai/h2o-3 version 3.46.0
Deployments exposing the typeahead endpoint to untrusted network input
H2O Flow web interface relying on the affected backend endpoint

Discovery Timeline

2025-03-20 - CVE-2024-8062 published to the National Vulnerability Database (NVD)
2025-03-26 - Last updated in NVD database
Public technical detail: Huntr Bounty Listing

Technical Details for CVE-2024-8062

Vulnerability Analysis

The typeahead endpoint in h2o-3 accepts a URL parameter and performs an HTTP HEAD request to confirm that the referenced resource exists. The HTTP client invocation does not set a connect or read timeout. When the remote server accepts the TCP connection but never returns a response, the server thread handling the typeahead request blocks indefinitely.

An unauthenticated attacker submits multiple typeahead requests pointing to a server they control. Each request consumes a worker thread that remains parked waiting for the upstream response. Once the worker pool is saturated, the H2O instance can no longer service legitimate API calls, model training requests, or Flow UI sessions.

Root Cause

The root cause is missing timeout configuration on the outbound HTTP client used by the typeahead handler. This pattern matches [CWE-1088], where synchronous access to a remote resource lacks an upper bound on wait time. The vulnerability also reflects insufficient validation of the destination host, since the endpoint follows requests to arbitrary attacker-supplied URLs.

Attack Vector

The attack is network-based, requires no authentication, and requires no user interaction. The exploitation chain involves three steps. The attacker deploys a TCP listener that accepts connections but never sends an HTTP response. The attacker then issues repeated typeahead requests to the target H2O instance with the URL parameter pointing at the listener. The H2O process accumulates blocked threads until the service stops responding to all clients.

No synthetic exploit code is included here. Refer to the Huntr Bounty Listing for the original technical write-up.

Detection Methods for CVE-2024-8062

Indicators of Compromise

Repeated inbound HTTP requests to the H2O typeahead endpoint containing external URL parameters
Outbound TCP connections from the H2O host to unfamiliar Internet destinations that remain in ESTABLISHED state without data transfer
Sudden growth in the number of blocked or waiting worker threads inside the H2O JVM process
Loss of responsiveness on the H2O Flow UI and REST API while the host CPU remains low

Detection Strategies

Inspect H2O access logs for high-frequency hits against the typeahead endpoint sourced from a single IP or small set of IPs.
Correlate inbound typeahead requests with outbound HTTP HEAD connections that exceed a normal duration threshold, for example 10 seconds.
Monitor JVM thread dumps for stacks parked in socket read operations originating from the typeahead handler.

Monitoring Recommendations

Alert on outbound connections from H2O hosts to destinations outside an approved allowlist.
Track HTTP request latency on the typeahead route and trigger when the 95th percentile rises above baseline.
Forward H2O application logs and host network telemetry into a centralized analytics platform for correlation across requests, threads, and egress flows.

How to Mitigate CVE-2024-8062

Immediate Actions Required

Restrict network exposure of the H2O typeahead endpoint to trusted users behind authenticated reverse proxies or VPNs.
Apply egress filtering so that the H2O host can only reach approved internal data sources, blocking arbitrary Internet destinations.
Rate-limit requests to the typeahead endpoint at the load balancer or reverse proxy layer.

Patch Information

No fixed version is listed in the available references for CVE-2024-8062. Operators running h2o-3 version 3.46.0 should monitor the h2o-3 project releases and the Huntr Bounty Listing for an upstream fix that introduces a request timeout on the outbound HEAD call.

Workarounds

Place H2O behind a reverse proxy that enforces an upstream connection and read timeout on requests to the typeahead route.
Deny outbound network access from the H2O host to any destination not required for legitimate data ingestion.
Disable or block the typeahead endpoint at the proxy layer if it is not used in the deployment.
Run H2O instances in isolated network segments so that a denial of service condition does not cascade to other services.

bash

# Example NGINX reverse proxy snippet enforcing timeouts and access control
location /3/Typeahead {
    allow 10.0.0.0/8;
    deny all;
    proxy_pass http://h2o_backend;
    proxy_connect_timeout 5s;
    proxy_send_timeout 5s;
    proxy_read_timeout 5s;
    limit_req zone=typeahead burst=10 nodelay;
}