AI and data stack advisories

Severe, 6 weeks1496Projects326

1496 severe, 6 weeks · 326 projects

H2O-3GHSA-58m3-rcvp-f9ww

h2o vulnerable to unexpected POST request shutting down server

H2O-3

CVE-2024-5979 · Published Jun 27, 2024 · updated Jul 7, 2026

High7.5
No fix yet
GitHub advisory

In h2oai/h2o-3 version 3.46.0, the run_tool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service.

Affected versions

PackageAffectedFixed in
h2o
PyPI
<= 3.46.0No fix yet
Details and references
CVSS 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Severity from
GitHub (reviewed advisory)
Weakness
CWE-400, CWE-94
Also known as
CVE-2024-5979, PYSEC-2026-1437

More H2O-3 advisories

All H2O-3