CVE-2024-7768: 
Java vulnerability analysis and mitigation

A vulnerability was discovered in the /3/ImportFiles endpoint of h2oai/h2o-3 version 3.46.1. The vulnerability was assigned CVE-2024-7768 and was disclosed on March 20, 2025. The affected component is the h2o-3 software package, specifically version 3.46.1 (NVD, CVE).

The vulnerability exists in the /3/ImportFiles endpoint which contains a design flaw in its parameter handling. The endpoint accepts a single GET parameter named path, which can be recursively set to reference itself. This recursive reference capability leads to a potential denial of service condition. The vulnerability has been assigned a CVSS v3.0 base score of 7.5 (HIGH) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The weakness has been categorized as CWE-400 (Uncontrolled Resource Consumption) (NVD).

When exploited, this vulnerability allows an attacker to cause a denial of service condition. The server repeatedly calls its own endpoint, which eventually fills up the request queue, rendering the server unable to handle other legitimate requests. This impact is reflected in the high availability impact score in the CVSS rating (NVD).

The vulnerability has a high exploitability potential due to its network accessibility (AV:N), low attack complexity (AC:L), and no requirements for privileges (PR:N) or user interaction (UI:N). The attack can be executed remotely by sending specially crafted requests to the affected endpoint (NVD).