CVE-2024-8062

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` request to verify the existence of a specified resource without setting a timeout. An attacker can exploit this by sending multiple requests to an attacker-controlled server that hangs, causing the application to block and become unresponsive to other requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-1088

Affected software

Vendor	Product	Versions
h2oai	h2oai/h2o-3	>= unspecified, <= latest

References

https://huntr.com/bounties/a04190d9-4acb-449a-9a7f-f1bf6be1ed23Exploit, Third Party Advisory
https://huntr.com/bounties/a04190d9-4acb-449a-9a7f-f1bf6be1ed23Exploit, Third Party Advisory

Timeline

Published: Mar 20, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-80637.5A divide by zero vulnerability exists in ollama/ollama version v0.3.3. The vulnerability occurs when importing GGUF models with a crafted ty CVE-2024-80658.1A Cross-Site Request Forgery (CSRF) vulnerability in version v1.4.1 of danswer-ai/danswer allows attackers to perform unauthorized actions i CVE-2024-80668.8The File Manager Pro – Filester plugin for WordPress is vulnerable to arbitrary file uploads due to missing validation in the 'fsConnector' CVE-2024-80675.8In versions of Helix Core prior to 2024.1 Patch 2 (2024.1/2655224) a Windows ANSI API Unicode "best fit" argument injection was identified.CVE-2024-80688.0Privilege escalation to NetworkService Account access in Citrix Session Recording when an attacker is an authenticated user in the same Wind CVE-2024-80698.0Limited remote code execution with privilege of a NetworkService Account access in Citrix Session Recording if the attacker is an authentica CVE-2024-80708.5CWE-312: Cleartext Storage of Sensitive Information vulnerability exists that exposes test credentials in the firmware binary CVE-2024-80717.2Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0 and 9.8.x <= 9.8.2 fail to restrict which roles can promote a user as s CVE-2024-80725.3Mage AI allows remote unauthenticated attackers to leak the terminal server command history of arbitrary users CVE-2024-80739.8Improper Input Validation vulnerability in Hillstone Networks Hillstone Networks Web Application Firewall on 5.5R6 allows Command Injection.CVE-2024-80749.3Missing Authentication for Critical Function, Missing Authorization vulnerability in Nomysoft Informatics Nomysem allows Collect Data as Pro CVE-2024-80759.8A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the