All vulnerabilities
CVE-2024-45758GHSA-hrmc-jmp7-mpm2PYSEC-2026-352

ai.h2o:h2o-core: H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

n/a ai.h2o:h2o-coremavenLibraries & packages
Open in ThreatlineRecord JSON
CVSS
9.1Critical
ExploitationPublic exploit codeCISA's assessment says proof of concept code is public, assessed 6 Sep 2024. Not in the KEV catalogCISA via CVE List
Exploit odds (EPSS)0.91%Chance of exploitation activity in the next 30 days, higher than 59% of CVEs. Scored 27 Oct 2026FIRST EPSS
Fixed inNone listedNo source names a fixed version. Check the vendor advisory below
Published6 Sep 2024Updated 27 Oct 2026CVE List

What fixes it

No source in this snapshot names a fixed version. The vendor advisories under References are the place to check.

Description

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.

Text from CVE List

Affected versions 105

  • ai.h2o:h2o-core, maven<= 3.46.0.7GitHub
  • h2o, pip<= 3.46.0.7GitHub
  • n/aaffected: n/aCVE List
  • ai.h2o:h2o-core, Mavenfrom first release, through 3.46.0.7OSV
  • ai.h2o:h2o-core, Maven0.1.10OSV
  • ai.h2o:h2o-core, Maven0.1.11OSV
  • ai.h2o:h2o-core, Maven0.1.12OSV
  • ai.h2o:h2o-core, Maven0.1.13OSV
  • ai.h2o:h2o-core, Maven0.1.14OSV
  • ai.h2o:h2o-core, Maven0.1.15OSV
  • ai.h2o:h2o-core, Maven0.1.16OSV
  • ai.h2o:h2o-core, Maven0.1.17OSV
  • ai.h2o:h2o-core, Maven0.1.18OSV
  • ai.h2o:h2o-core, Maven0.1.19OSV
  • ai.h2o:h2o-core, Maven0.1.20OSV
  • ai.h2o:h2o-core, Maven0.1.21OSV
  • ai.h2o:h2o-core, Maven0.1.22OSV
  • ai.h2o:h2o-core, Maven0.1.23OSV
  • ai.h2o:h2o-core, Maven0.1.24OSV
  • ai.h2o:h2o-core, Maven0.1.25OSV
  • ai.h2o:h2o-core, Maven0.1.3OSV
  • ai.h2o:h2o-core, Maven0.1.3.1OSV
  • ai.h2o:h2o-core, Maven0.1.4OSV
  • ai.h2o:h2o-core, Maven0.1.5OSV
  • ai.h2o:h2o-core, Maven0.1.6OSV
  • ai.h2o:h2o-core, Maven0.1.8OSV
  • ai.h2o:h2o-core, Maven0.1.9OSV
  • ai.h2o:h2o-core, Maven0.2.3.5OSV
  • ai.h2o:h2o-core, Maven0.2.3.6OSV
  • ai.h2o:h2o-core, Maven0.3.0.2OSV
  • ai.h2o:h2o-core, Maven3.0.0.12OSV
  • ai.h2o:h2o-core, Maven3.0.0.16OSV
  • ai.h2o:h2o-core, Maven3.0.0.18OSV
  • ai.h2o:h2o-core, Maven3.0.0.19OSV
  • ai.h2o:h2o-core, Maven3.0.0.22OSV
  • ai.h2o:h2o-core, Maven3.0.0.25OSV
  • ai.h2o:h2o-core, Maven3.0.0.26OSV
  • ai.h2o:h2o-core, Maven3.0.0.30OSV
  • ai.h2o:h2o-core, Maven3.0.0.5OSV
  • ai.h2o:h2o-core, Maven3.0.0.8OSV
  • ai.h2o:h2o-core, Maven3.0.1.2OSV
  • ai.h2o:h2o-core, Maven3.0.1.3OSV
  • ai.h2o:h2o-core, Maven3.0.1.4OSV
  • ai.h2o:h2o-core, Maven3.10.0.1OSV
  • ai.h2o:h2o-core, Maven3.10.0.10OSV
  • ai.h2o:h2o-core, Maven3.10.0.2OSV
  • ai.h2o:h2o-core, Maven3.10.0.3OSV
  • ai.h2o:h2o-core, Maven3.10.0.4OSV
  • ai.h2o:h2o-core, Maven3.10.0.5OSV
  • ai.h2o:h2o-core, Maven3.10.0.6OSV
  • ai.h2o:h2o-core, Maven3.10.0.7OSV
  • ai.h2o:h2o-core, Maven3.10.0.8OSV
  • ai.h2o:h2o-core, Maven3.10.0.9OSV
  • ai.h2o:h2o-core, Maven3.10.1.1OSV
  • h2o, PyPIfrom first release, through 3.46.0.7OSV
  • h2o, PyPI3.10.0.10OSV
  • h2o, PyPI3.10.0.3OSV
  • h2o, PyPI3.10.0.6OSV
  • h2o, PyPI3.10.0.7OSV
  • h2o, PyPI3.10.0.8OSV
  • h2o, PyPI3.10.3.3OSV
  • h2o, PyPI3.10.3.4OSV
  • h2o, PyPI3.10.4.1OSV
  • h2o, PyPI3.10.4.2OSV
  • h2o, PyPI3.10.4.3OSV
  • h2o, PyPI3.10.4.4OSV
  • h2o, PyPI3.10.4.6OSV
  • h2o, PyPI3.10.4.8OSV
  • h2o, PyPI3.16.0.1OSV
  • h2o, PyPI3.16.0.2OSV
  • h2o, PyPI3.16.0.3OSV
  • h2o, PyPI3.16.0.4OSV
  • h2o, PyPI3.18.0.1OSV
  • h2o, PyPI3.18.0.10OSV
  • h2o, PyPI3.18.0.11OSV
  • h2o, PyPI3.18.0.2OSV
  • h2o, PyPI3.18.0.3OSV
  • h2o, PyPI3.18.0.4OSV
  • h2o, PyPI3.18.0.5OSV
  • h2o, PyPI3.18.0.6OSV
  • h2o, PyPI3.18.0.7OSV
  • h2o, PyPI3.18.0.8OSV
  • h2o, PyPI3.18.0.9OSV
  • h2o, PyPI3.20.0.4OSV
  • h2o, PyPI3.20.0.5OSV
  • h2o, PyPI3.20.0.6OSV
  • h2o, PyPI3.20.0.7OSV
  • h2o, PyPI3.20.0.8OSV
  • h2o, PyPI3.22.0.1OSV
  • h2o, PyPI3.22.0.2OSV
  • h2o, PyPI3.22.0.3OSV
  • h2o, PyPI3.22.0.4OSV
  • h2o, PyPI3.22.0.5OSV
  • h2o, PyPI3.22.1.1OSV
  • h2o, PyPI3.22.1.2OSV
  • h2o, PyPI3.22.1.3OSV
  • h2o, PyPI3.22.1.4OSV
  • h2o, PyPI3.22.1.5OSV
  • h2o, PyPI3.22.1.6OSV
  • h2o, PyPI3.24.0.1OSV
  • h2o, PyPI3.24.0.2OSV
  • h2o, PyPI3.24.0.3OSV
  • h2o, PyPI3.24.0.4OSV
  • h2o, PyPI3.24.0.5OSV
  • h2o, PyPI3.26.0.1OSV

References 10