CVE-2024-5979: DoS in h2o-3

The core impact of CVE-2024-5979 is a denial-of-service. An attacker can remotely trigger a crash in the h2o-3 server by crafting a malicious request that targets the MojoConvertTool within the run_tool command. This crash effectively renders the server unavailable, disrupting machine learning workflows and potentially impacting dependent applications. The blast radius extends to any service relying on the vulnerable h2o-3 instance, potentially affecting data scientists, machine learning engineers, and downstream consumers of the model predictions. While the vulnerability doesn't directly lead to data exfiltration or code execution, the service disruption can have significant operational consequences.

1. Reserved2024-06-13
2. Published2024-06-27
3. Modified2025-10-16
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-5979 is to upgrade to version 3.46.0.6 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider implementing input validation on the runtool command to prevent the execution of potentially malicious arguments. While a WAF is unlikely to directly address this vulnerability, rate limiting requests to the runtool endpoint could help mitigate the impact of a denial-of-service attack. After upgrading, confirm the fix by attempting to invoke the MojoConvertTool with an invalid argument and verifying that the server does not crash.