CVEvulnerability

CVE-2025-6544

9.8 CRITICAL Published 2025-09-21 Modified 2026-10-05 Official page ↗
Status
Analyzed
Published
2025-09-21
Last modified
2026-10-05
Assigner
[email protected]
CVSS 3.0 ([email protected])
9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502

Description

A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.

Affected configurations

• h2o h2o (>= 3.0.0.2 <= 3.46.0.8)

Related

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References