CVE-2026-8751: medium-severity vulnerability in h2oai h2o-3
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.9epss 0.4%
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P
Affected products
h2oai · h2o-3public PoCs found — 1
cve_referencevulnplus-note.wetolink.com/share/b5nsQg6EcsBSunverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — h2oai h2o-3
In the same product, most dangerous first.
CVE-2024-8862MEDIUMh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationEPSS 1.3%CVE-2025-10769MEDIUMh2oai h2o-3 H2 JDBC Driver ImportSQLTable deserializationEPSS 0.5%CVE-2026-8750MEDIUMh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosureEPSS 0.5%CVE-2025-10768MEDIUMh2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserializationEPSS 0.4%CVE-2026-8752MEDIUMh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access controlEPSS 0.3%