CVE-2024-10549

A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service.

• CWE-1333

• https://huntr.com/bounties/ce7bd2d6-fd38-440d-a91a-dd8f3fc06bc2Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10543The Tumult Hype Animations plugin for WordPress is vulnerabl…4.3
• CVE-2024-10544The Woo Manage Fraud Orders plugin for WordPress is vulnerab…5.3
• CVE-2024-10545The Photo Gallery, Sliders, Proofing and WordPress plugin …3.5
• CVE-2024-10546A vulnerability classified as critical was found in open-scr…6.3
• CVE-2024-10547The WP Membership plugin for WordPress is vulnerable to arbi…9.8
• CVE-2024-10548The WP Project Manager plugin for WordPress is vulnerable to…6.5
• CVE-2024-1055The PowerPack Addons for Elementor (Free Widgets, Extensions…5.4
• CVE-2024-10550A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o…7.5
• CVE-2024-10551The Sticky Social Icons WordPress plugin through 1.2.1 does …4.8
• CVE-2024-10552The Flexmls® IDX Plugin plugin for WordPress is vulnerable t…6.4
• CVE-2024-10553A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.…9.8
• CVE-2024-10554The WordPress WP-Advanced-Search WordPress plugin before 3.3…3.5