CVE-2025-10768Medium· 6.3▾ SunlitA flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. …
▾ Sunlit zone — Low / medium · no exploitation signal
impact 34.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 30.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
0.4%
0.4% → 0.4%
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
h2o >= 3.0.0.2, <= 3.46.0.8Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-8751High· 7.3A security flaw has been discovered in h2oai h2o-3 up to 7402
CVE-2024-10553Critical· 9.8H2O Deserialization of Untrusted Data Vulnerability
CVE-2025-6544Critical· 9.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code
CVE-2023-6569Critical· 9.3External Control of File Name or Path in h2oai/h2o-3
CVE-2024-45758Critical· 9.1H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
CVE-2026-8752Medium· 5.3A weakness has been identified in h2oai h2o-3 up to 7402