CVE-2024-10553

CRITICAL

h2o < 3.46.0.6 - Unauthenticated Remote Code Execution via JDBC URL Deserialization

Title source: llm
STIX 2.1

Description

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.

References (2)

Core 2

Scores

CVSS v3 9.8
EPSS 0.0286
EPSS Percentile 86.4%
Attack Vector NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact total

Details

CWE
CWE-502
Status published
Products (3)
ai.h2o/h2o-core 0 - 3.46.0.6Maven
h2o/h2o 3.46.0.4
pypi/h2o 0 - 3.46.0.6PyPI
Published Mar 20, 2025
Tracked Since Feb 18, 2026