CVE-2024-10550

Summary

CVE-2024-10550 is a newly disclosed vulnerability affecting the `/3/ParseSetup` endpoint in h2oai/h2o-3 version 3.46.0.1. This issue allows an attacker to initiate a denial of service (DoS) attack by manipulating a user-controllable string and applying a maliciously crafted regular expression. The vulnerability results in excessive regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive. This can cause significant disruption to affected systems. Users of h2oai/h2o-3 version 3.46.0.1 are advised to apply patches or updates as soon as possible to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.