GitHub Advisoryadvisory · PyPI, Maven

GHSA-h7xg-cmpp-48hf H2O Deserialization of Untrusted Data Vulnerability

CRITICAL Published 2025-03-20 Modified 2026-10-27 Official page ↗
Aliases
CVE-2024-10553
Ecosystem
PyPI, Maven
Packages
h2o, ai.h2o:h2o-core
Severity
Critical
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2025-03-20

Affected packages

• PyPI h2o: < 3.46.0.6 → fixed in 3.46.0.6 • Maven ai.h2o:h2o-core: < 3.46.0.6 → fixed in 3.46.0.6

Description

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.46.0.6.

Related

Alias · CVE (1)

  • CVE-2024-10553 A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References