H2O.ai H2O-3 Denial-of-Service Vulnerability via Large GZIP File Uploads

A denial-of-service vulnerability has been identified in H2O.ai H2O-3 version 3.46.0.2. The issue arises when a large GZIP file is uploaded and repeatedly parsed, causing the server to become unresponsive. This unresponsiveness is due to memory exhaustion and a high number of concurrent, slow-running jobs. The vulnerability stems from improper handling of highly compressed data, which leads to significant data amplification.

Impact

Exploitation of this vulnerability causes memory exhaustion, leading to server unresponsiveness. Additionally, it creates a large number of concurrent jobs that run slowly, further degrading server performance.