h2oai h2o-3 Denial-of-Service Vulnerability in ParseSetup Endpoint

A denial-of-service vulnerability has been identified in h2oai/h2o-3 version 3.46.0.1. The issue arises in the '/3/ParseSetup' endpoint, where user-specified regular expressions are applied to user-controllable strings. This can be exploited to create inefficient regular expression complexities that exhaust server resources, causing the server to become unresponsive.

Impact

Exploitation of this vulnerability leads to a denial-of-service condition, causing the server to become unresponsive due to resource exhaustion.