h2o vulnerabilities
CVEs whose affected-version data names the h2o package (maven, pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
21 CVEsRSS
CVE-2026-8752Medium· 5.3A weakness has been identified in h2oai h2o-3 up to 7402
A weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handl…
CVE-2026-8751High· 7.3A security flaw has been discovered in h2oai h2o-3 up to 7402
A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserializati…
CVE-2026-8750Medium· 5.3A vulnerability was identified in h2oai h2o-3 up to 7402
A vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to inf…
CVE-2026-3960Critical· 9.8A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0…
A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blackl…
CVE-2024-5986Critical· 9.1H2O has an External Control of File Name or Path vulnerability
H2O has an External Control of File Name or Path vulnerability
CVE-2025-6544Critical· 9.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, whic…
CVE-2025-10768Medium· 6.3A flaw has been found in h2oai h2o-3 up to 3.46.08
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. …
CVE-2024-10553Critical· 9.8H2O Deserialization of Untrusted Data Vulnerability
H2O Deserialization of Untrusted Data Vulnerability
CVE-2024-10549High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint
CVE-2024-10572High· 7.5H2O Vulnerable to Denial of Service (DoS) and File Write
H2O Vulnerable to Denial of Service (DoS) and File Write
CVE-2024-7768High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint
CVE-2024-6863Medium· 6.5H2O Vulnerable to Execution of Arbitrary Files
H2O Vulnerable to Execution of Arbitrary Files
CVE-2024-8616High· 8.2H2O Vulnerable to Arbitrary File Overwrite
H2O Vulnerable to Arbitrary File Overwrite
CVE-2024-10550High· 7.5H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint
CVE-2024-7765High· 7.5H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing
CVE-2024-8062High· 7.5H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request
CVE-2024-6854High· 7.1H2O Vulnerable to Arbitrary File Overwrite via File Export
H2O Vulnerable to Arbitrary File Overwrite via File Export
CVE-2024-45758Critical· 9.1H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
CVE-2024-5979High· 7.5h2o vulnerable to unexpected POST request shutting down server
h2o vulnerable to unexpected POST request shutting down server
CVE-2024-5550Medium· 5.3Arbitrary system path lookup in h20
Arbitrary system path lookup in h20
CVE-2023-6569Critical· 9.3External Control of File Name or Path in h2oai/h2o-3
External Control of File Name or Path in h2oai/h2o-3