CVE-2024-5979 - Vulnerability Details - OpenCVE

In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service.

No CVSS v4.0

No CVSS v3.1

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
H2o	H2o
H2oai	H2o-3

Configuration 1 [-]

cpe:2.3:a:h2o:h2o:3.46.0:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5
https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458

History

Wed, 15 Oct 2025 13:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-400

Wed, 15 Oct 2025 13:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-94
References		https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.00157}`	epss `{'score': 0.0017}`

Tue, 15 Jul 2025 13:30:00 +0000

Type	Values Removed	Values Added
First Time appeared		H2o H2o h2o
CPEs		cpe:2.3:a:h2o:h2o:3.46.0:::::::*
Vendors & Products		H2o H2o h2o

MITRE

Status: PUBLISHED

Assigner: @huntr_ai

Published: 2024-06-27T18:40:07.230Z

Updated: 2025-10-15T12:49:44.742Z

Reserved: 2024-06-13T17:38:41.146Z

Link: CVE-2024-5979

Vulnrichment

Updated: 2024-08-01T21:25:03.168Z

NVD

Status : Modified

Published: 2024-06-27T19:15:18.560

Modified: 2025-10-15T13:15:48.333

Link: CVE-2024-5979

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-5979", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "state": "PUBLISHED", "assignerShortName": "@huntr_ai", "dateReserved": "2024-06-13T17:38:41.146Z", "datePublished": "2024-06-27T18:40:07.230Z", "dateUpdated": "2025-10-15T12:49:44.742Z"}, "containers": {"cna": {"title": "Denial of Service via Invalid Argument in h2oai/h2o-3", "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2025-10-15T12:49:44.742Z"}, "descriptions": [{"lang": "en", "value": "In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service."}], "affected": [{"vendor": "h2oai", "product": "h2oai/h2o-3", "versions": [{"version": "unspecified", "lessThan": "3.46.0.6", "status": "affected", "versionType": "custom"}]}], "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458"}, {"url": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"}], "metrics": [{"cvssV3_0": {"version": "3.0", "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "baseScore": 7.5, "baseSeverity": "HIGH"}}], "problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-94 Improper Control of Generation of Code", "cweId": "CWE-94"}]}], "source": {"advisory": "d80a2139-fc03-44b7-b739-de41e323b458", "discovery": "EXTERNAL"}}, "adp": [{"affected": [{"vendor": "h2oai", "product": "h2oai\\/h2o-3", "cpes": ["cpe:2.3:a:h2oai:h2oai\\/h2o-3:3.40.0.4:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "3.46.0", "status": "affected"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-19T15:30:49.270789Z", "id": "CVE-2024-5979", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T15:32:37.908Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.168Z"}, "title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T21:25:03.168Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-5979", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-07-19T15:30:49.270789Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:h2oai:h2oai\\/h2o-3:3.40.0.4:*:*:*:*:*:*:*"], "vendor": "h2oai", "product": "h2oai\\/h2o-3", "versions": [{"status": "affected", "version": "3.46.0"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-19T15:32:32.923Z"}}], "cna": {"title": "Denial of Service via Invalid Argument in h2oai/h2o-3", "source": {"advisory": "d80a2139-fc03-44b7-b739-de41e323b458", "discovery": "EXTERNAL"}, "metrics": [{"cvssV3_0": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}], "affected": [{"vendor": "h2oai", "product": "h2oai/h2o-3", "versions": [{"status": "affected", "version": "unspecified", "versionType": "custom", "lessThanOrEqual": "latest"}]}], "references": [{"url": "https://huntr.com/bounties/d80a2139-fc03-44b7-b739-de41e323b458"}], "descriptions": [{"lang": "en", "value": "In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called. One such class, `MojoConvertTool`, crashes the server when invoked with an invalid argument, causing a denial of service."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-400", "description": "CWE-400 Uncontrolled Resource Consumption"}]}], "providerMetadata": {"orgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "shortName": "@huntr_ai", "dateUpdated": "2024-06-27T18:40:07.230Z"}}}, "cveMetadata": {"cveId": "CVE-2024-5979", "state": "PUBLISHED", "dateUpdated": "2024-08-01T21:25:03.168Z", "dateReserved": "2024-06-13T17:38:41.146Z", "assignerOrgId": "c09c270a-b464-47c1-9133-acb35b22c19a", "datePublished": "2024-06-27T18:40:07.230Z", "assignerShortName": "@huntr_ai"}, "dataVersion": "5.1"}