Description
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
References (2)
Core 2
Core References
Exploit, Third Party Advisory
https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40
Scores
CVSS v3
9.8
EPSS
0.0057
EPSS Percentile
68.8%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA SSVC
Vulnrichment
Exploitation
poc
Automatable
yes
Technical Impact
total
Details
CWE
CWE-502
Status
published
Products (3)
ai.h2o/h2o-core
0Maven
h2o/h2o
3.0.0.2 - 3.46.0.8
pypi/h2o
0PyPI
Published
Sep 21, 2025
Tracked Since
Feb 18, 2026