CVE-2025-10768: medium-severity vulnerability in h2oai h2o-3
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 5.3epss 0.4%
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
h2oai · h2o-3Related CVEs — h2oai h2o-3
In the same product, most dangerous first.
CVE-2024-8862MEDIUMh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationEPSS 1.3%CVE-2025-10769MEDIUMh2oai h2o-3 H2 JDBC Driver ImportSQLTable deserializationEPSS 0.5%CVE-2026-8750MEDIUMh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosureEPSS 0.5%CVE-2026-8751MEDIUMh2oai h2o-3 JAR Model.java importBinaryModel deserializationEPSS 0.4%CVE-2026-8752MEDIUMh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access controlEPSS 0.3%