Back to Database
Status published
High
CVE-2024-7768
Denial of Service in h2oai/h2o-3
Vulnerability Description
A vulnerability in the `/3/ImportFiles` endpoint of h2oai/h2o-3 version 3.46.1 allows an attacker to cause a denial of service. The endpoint takes a single GET parameter, `path`, which can be recursively set to reference itself. This leads the server to repeatedly call its own endpoint, eventually filling up the request queue and leaving the server unable to handle other requests.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-7768
Credits & Attribution
No credits recorded in the NVD database.
More from h2oai
View All →CVE-2025-6544
Deserialization Vulnerability in h2oai/h2o-3
Critical
9.8
CVE-2025-6507
Deserialization of Untrusted Data in h2oai/h2o-3
Critical
9.8
CVE-2025-5662
Deserialization Vulnerability in h2oai/h2o-3
Critical
9.8
CVE-2025-10769
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
Medium
5.3
CVE-2025-10768
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
Medium
5.3
Affected Vendor
h2oai
View all reports →Affected Software
h2oai/h2o-3
Vulnerable Versions:
unspecified
Timeline
Official Publish:
March 20th, 2025
Last Modified:
October 15th, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H