CRITICAL 9.8 Maven
H2O affected by a deserialization vulnerability
GHSA-5w3j-gwgh-4rfv · CVE-2025-6544 · PYSEC-2026-349
Published · Modified
AI SAST
Find this class of vulnerability in your own code
Corgea's AI-native static analysis detects vulnerabilities like this one across your repositories, ranks them by exploitability, and returns review-ready fixes.
Description
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.7, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
Ready to move
Start Securing
Free, no credit card | First findings in minutes