h2oai h2o-3 Denial-of-Service Vulnerability in the Parse Endpoint

A denial-of-service vulnerability has been identified in h2oai/h2o-3 version 3.46.0.1. The issue arises in the '/3/Parse' endpoint, where user-specified strings are used to create regular expressions applied to other user-specified strings. An attacker can exploit this by sending multiple simultaneous requests, exhausting available threads and causing a complete denial of service.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the application to become unresponsive or unavailable.