CVE-2024-5979

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

CVE-2024-5979 Denial of Service via Invalid Argument in h2oai/h2o-3

In h2oai/h2o-3 version 3.46.0, the runtool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service...

CVE-2024-5979

CVE-2024-5979 affects h2oai/h2o-3 (version 3.46.0). The issue arises in the rapids component: the run_tool command can invoke the main() of any class under water.tools, enabling MojoConvertTool to crash the server and cause denial of service. Exploitation details are not provided in the sources; ...