CVE-2024-7765
CVSS 3.1 Score 7.5 of 10 (high)
Details
Published Mar 20, 2025
Updated: Apr 1, 2025
CWE ID 409
Summary
CVE-2024-7765 is a denial-of-service vulnerability affecting h2oai's h2o-3 version 3.46.0.2. By uploading and parsing a large GZIP file repeatedly, an attacker can cause memory exhaustion and make the server unresponsive. The severity stems from the software's inability to handle highly compressed data properly, resulting in significant data amplification. This issue could lead to a large number of concurrent slow-running jobs, ultimately impacting the availability and performance of the affected system.
Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.
Affected Products
- h2oai h2o-3
Affected Vendors
- H2O.ai