CVE-2024-10550

A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive.

• CWE-1333

• https://huntr.com/bounties/ef3f4d89-3b8b-4618-b134-cb93c1664ec6Exploit, Third Party Advisory

Published

Mar 20, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-10545The Photo Gallery, Sliders, Proofing and WordPress plugin …3.5
• CVE-2024-10546A vulnerability classified as critical was found in open-scr…6.3
• CVE-2024-10547The WP Membership plugin for WordPress is vulnerable to arbi…9.8
• CVE-2024-10548The WP Project Manager plugin for WordPress is vulnerable to…6.5
• CVE-2024-10549A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 ve…7.5
• CVE-2024-1055The PowerPack Addons for Elementor (Free Widgets, Extensions…5.4
• CVE-2024-10551The Sticky Social Icons WordPress plugin through 1.2.1 does …4.8
• CVE-2024-10552The Flexmls® IDX Plugin plugin for WordPress is vulnerable t…6.4
• CVE-2024-10553A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.…9.8
• CVE-2024-10554The WordPress WP-Advanced-Search WordPress plugin before 3.3…3.5
• CVE-2024-10555The WordPress Button Plugin MaxButtons WordPress plugin befo…4.8
• CVE-2024-10556A vulnerability, which was classified as critical, was found…9.8