In h2oai/h2o-3 version 3.46.0, the run_tool command in the rapids component allows the main function of any class under the water.tools namespace to be called. One such class, MojoConvertTool, crashes the server when invoked with an invalid argument, causing a denial of service.
"2026-04-12T11:14:34Z"
[
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "3.46.0"
}
]
}
]
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-5979.json"
[
{
"digest": {
"length": 481.0,
"function_hash": "63212059137833744616362604802638000888"
},
"target": {
"file": "h2o-core/src/main/java/water/rapids/ast/prims/internal/AstRunTool.java",
"function": "apply"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-116f6db0",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"219164803784699755326794982544510850731",
"313455051942071705232783445630011255107",
"78935177215728822641111480415432302098",
"52278223232067590422472437988556039158",
"50998665129343113505160596300818186638",
"11892617308310517244344850020140843493",
"323184067977770371498729625593725479692",
"330858426271269473889853852801892883351",
"285839345093348396213066115904923304703",
"218128771732266315693509171612082302718",
"207902805205985286939866182920939608959",
"159691013384147952536263258533864260568",
"237435552262996469802304873517762563149",
"104255676702243858395366928406771402893",
"2457023200219273116034348553692931630",
"48618095688199252206931089643383983858",
"250616732674384367985148773441131838690",
"198862271076670384602749944784440767534",
"10516275875969589781819836371646447011",
"235994172176894905960989146978959434640"
]
},
"target": {
"file": "h2o-algos/src/main/java/water/tools/MojoConvertTool.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-2eb37724",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"length": 141.0,
"function_hash": "60588435464252322399129357323893182174"
},
"target": {
"file": "h2o-algos/src/main/java/water/tools/MojoConvertTool.java",
"function": "usage"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-458e0b74",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"14869851635955531264287960103652645571",
"213002412588002614693684898456325740223",
"319554490528477749845428017140962946084",
"300586737785143607300444196425584958160",
"125416689984323449453967757059928509592",
"264143407642948763983660041065718716512",
"657064142475156768056656741146869939"
]
},
"target": {
"file": "h2o-core/src/main/java/water/rapids/ast/prims/internal/AstRunTool.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-54cceeec",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"117258023558901996055412282345408982470",
"119402654365940021742892660169473968092",
"19632367966154490296291284360077392679",
"278796734075853806679750071018185692969",
"131745577787510228921307574746992932103",
"171333251058482760844839935989252708601",
"118557380436808745186125147018675318749",
"276490914758026507738852191465338338697",
"226505876782268440838788078300374862424",
"99423376990175155587457846491359596983",
"290411755761142493163709486524495026116",
"226793365258332886090632390196897132191",
"319570448347645371684693452678629757673",
"103923039392421058262050068861149086228",
"63246886776746932383498991992466503881",
"290302841600790140449151798518198316226",
"192946104546970798993453440438889839532"
]
},
"target": {
"file": "h2o-extensions/xgboost/src/main/java/water/tools/XGBoostLibExtractTool.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-7720c196",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"length": 1207.0,
"function_hash": "301859752983507596706188208124757176774"
},
"target": {
"file": "h2o-algos/src/main/java/water/tools/MojoConvertTool.java",
"function": "main"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-9bd3e3a3",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"length": 830.0,
"function_hash": "179922640318796993273786848035075084844"
},
"target": {
"file": "h2o-extensions/xgboost/src/main/java/water/tools/XGBoostLibExtractTool.java",
"function": "main"
},
"signature_type": "Function",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-9e0e6ac1",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
},
{
"digest": {
"threshold": 0.9,
"line_hashes": [
"136860750665064098911377068728372372293",
"133903171558892504602291201137511147286",
"128759165416978476339728731749133440242",
"81293052053071009036632636955385253868"
]
},
"target": {
"file": "h2o-core/src/main/java/water/tools/EncryptionTool.java"
},
"signature_type": "Line",
"signature_version": "v1",
"deprecated": false,
"id": "CVE-2024-5979-b5f33c89",
"source": "https://github.com/h2oai/h2o-3/commit/d0899f8e0f7a584b60405a65b1d7b439aaaa55a5"
}
]