CVE-2024-5979 - Vulnerability Details - OpenCVE

In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
H2o	H2o

Configuration 1 [-]

cpe:2.3:a:h2o:h2o:3.46.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00157}`	epss `{'score': 0.0017}`

Tue, 15 Jul 2025 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		H2o H2o h2o
CPEs		cpe:2.3:a:h2o:h2o:3.46.0:::::::*
Vendors & Products		H2o H2o h2o

MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-06-27T18:40:07.230Z

Updated: 2024-08-01T21:25:03.168Z

Reserved: 2024-06-13T17:38:41.146Z

Link: CVE-2024-5979

Vulnrichment

Updated: 2024-08-01T21:25:03.168Z

NVD

Status : Analyzed

Published: 2024-06-27T19:15:18.560

Modified: 2025-07-15T13:28:58.003

Link: CVE-2024-5979

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5979", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-06-13T17:38:41.146Z", "datePublished": "2024-06-27T18:40:07.230Z", "dateUpdated": "2024-08-01T21:25:03.168Z"}, "containers": {"cna": {"title": "Denial of Service via Invalid Argument in h2oai/h2o-3", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-06-27T18:40:07.230Z"}, "descriptions": [{"lang": "en", "value": "In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service."}], "affected": [{"vendor": "h2oai", "product": "h2oai/h2o-3", "versions": [{"version": "unspecified", "status": "affected", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-400 Uncontrolled Resource Consumption", "cweId": "CWE-400"}]}], "source": {"advisory": "d80a2139-fc03-44b7-b739-de41e323b458", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "h2oai", "product": "h2oai\\/h2o-3", "cpes": ["cpe:2.3:a:h2oai:h2oai\\/h2o-3:3.40.0.4:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.46.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-19T15:30:49.270789Z", "id": "CVE-2024-5979", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T15:32:37.908Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.168Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.168Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5979", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-19T15:30:49.270789Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:h2oai:h2oai\\/h2o-3:3.40.0.4:*:*:*:*:*:*:*"], "vendor": "h2oai", "product": "h2oai\\/h2o-3", "versions": [{"status": "affected", "version": "3.46.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T15:32:32.923Z"}}], "cna": {"title": "Denial of Service via Invalid Argument in h2oai/h2o-3", "source": {"advisory": "d80a2139-fc03-44b7-b739-de41e323b458", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "h2oai", "product": "h2oai/h2o-3", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458"}], "descriptions": [{"lang": "en", "value": "In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-06-27T18:40:07.230Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5979", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:25:03.168Z", "dateReserved": "2024-06-13T17:38:41.146Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-06-27T18:40:07.230Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}