Denial of Service in h2oai/h2o-3

Vulnerability

Overview

The typeahead endpoint in H2O-3 version 3.46.0 performs a HEAD request to verify the existence of a specified resource without setting a timeout [2]. This missing timeout allows an attacker to cause a denial of service (DoS) by forcing the application to wait indefinitely for a response from a resource under the attacker's control.

Exploitation

Details

An attacker can exploit this vulnerability by sending multiple requests to the typeahead endpoint that reference an attacker-controlled server configured to hold the connection open indefinitely [2]. Since the HEAD request never completes, the application's worker threads become blocked, consuming resources and preventing the processing of legitimate requests. No authentication is required to reach the endpoint [4].

Impact

A successful attack renders the H2O-3 application unresponsive to legitimate users, resulting in a complete denial of service. The vulnerability is easily exploitable with minimal effort and does not require any special privileges [4].

Mitigation

At the time of publication, no official patch has been released for this vulnerability [1]. Users are advised to restrict network access to the typeahead endpoint, implement external request timeouts, or apply workarounds such as limiting incoming request rates [3]. The code in question is located in PersistManager.java [3].