HIGH7.5
PYSEC-2026-1439
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
Details
In h2oai/h2o-3 version 3.46.0.2, a vulnerability exists where uploading and repeatedly parsing a large GZIP file can cause a denial of service. The server becomes unresponsive due to memory exhaustion and a large number of concurrent slow-running jobs. This issue arises from the improper handling of highly compressed data, leading to significant data amplification.
Are you affected?
Enter the version of the package you're using.
Affected packages
PyPI/h2o
Introduced in:
3.32.1.2No fixed version published yet for h2o (pip). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2024-7765[ADVISORY]
- https://github.com/h2oai/h2o-3[PACKAGE]
- https://github.com/h2oai/h2o-3/blob/7d418fa19d3ab434f742818e37f891bef9102c97/h2o-core/src/main/java/water/parser/ParseDataset.java#L900[WEB]
- https://huntr.com/bounties/0e58b1a5-bdca-4e60-af92-09de9c76a9ff[WEB]
- https://pypi.org/project/h2o[PACKAGE]
- https://github.com/advisories/GHSA-6w62-3jvj-mfj6[ADVISORY]