CVE-2024-8062

Katalog CVE

CVSS 7.5 · High EPSS 0,48%

Kerentanan Synchronous Access of Remote Resource without Timeout pada h2o. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.

Rincian

Terbit di NVD

20 Maret 2025

Terakhir diubah

17 Juni 2026

Status NVD

Analyzed

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-1088: Synchronous Access of Remote Resource without Timeout

EPSS (30 hari)

0,48% peluang dieksploitasi; lebih tinggi dari 39,8% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://huntr.com/bounties/a04190d9-4acb-449a-9a7f-f1bf6be1ed23 exploit · advisory pihak ketiga