High severityNVD Advisory· Published Mar 20, 2025· Updated Oct 15, 2025
Denial of Service and Arbitrary File Write in h2oai/h2o-3
CVE-2024-10572
Description
In h2oai/h2o-3 version 3.46.0.1, the run_tool command exposes classes in the water.tools package through the ast parser. This includes the XGBoostLibExtractTool class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
h2oPyPI | >= 3.34.0.1, <= 3.46.0.1 | — |
ai.h2o:h2o-ext-xgboostMaven | >= 3.34.0.1, <= 3.46.0.1 | — |
Affected products
3- ghsa-coords2 versions
>= 3.34.0.1, <= 3.46.0.1+ 1 more
- (no CPE)range: >= 3.34.0.1, <= 3.46.0.1
- (no CPE)range: >= 3.34.0.1, <= 3.46.0.1
Patches
Vulnerability mechanics
References
4- github.com/advisories/GHSA-wjpv-64v2-2qpqghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-10572ghsaADVISORY
- github.com/h2oai/h2o-3/blob/5e45e780f597961bda73adff765976db975f204b/h2o-extensions/xgboost/src/main/java/water/tools/XGBoostLibExtractTool.javaghsaWEB
- huntr.com/bounties/db8939a0-9be8-4d0f-a8b0-1bd181666da2ghsaWEB
News mentions
0No linked articles in our index yet.