CVE-2025-6544criticalCWE-502

CVE-2025-6544: critical vulnerability in h2oai/h2o-3

Deserialization Vulnerability in h2oai/h2o-3

Published · Updated

Follow this CVE+ Monitor h2oai/h2o-3+ Monitor h2o

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 9.8epss 1.0%
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
h2oai · h2oai/h2o-3
Related CVEs — h2oai/h2o-3

In the same product, most dangerous first.

CVE-2023-6016CRITICALH2O Remote Code Execution via POJO Model ImportEPSS 30.6%CVE-2025-6507CRITICALDeserialization of Untrusted Data in h2oai/h2o-3EPSS 17.3%CVE-2023-6038CRITICALLocal File Inclusion in h2oai/h2o-3EPSS 4.3%CVE-2024-10553CRITICALJdbc Deserialization in h2oai/h2o-3EPSS 1.6%CVE-2026-3960MEDIUMRemote Code Execution in h2oai/h2o-3EPSS 0.9%CVE-2023-6017HIGHH2O S3 Bucket TakeoverEPSS 0.9%