Back to Database
Status published
Critical
CVE-2025-6544
Deserialization Vulnerability in h2oai/h2o-3
Vulnerability Description
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-6544
Credits & Attribution
No credits recorded in the NVD database.
References
More from h2oai
View All →CVE-2025-6507
Deserialization of Untrusted Data in h2oai/h2o-3
Critical
9.8
CVE-2025-5662
Deserialization Vulnerability in h2oai/h2o-3
Critical
9.8
CVE-2025-10769
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
Medium
5.3
CVE-2025-10768
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
Medium
5.3
CVE-2024-8862
h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization
Medium
6.9
Affected Vendor
h2oai
View all reports →Affected Software
h2oai/h2o-3
Vulnerable Versions:
unspecified
Timeline
Official Publish:
September 21st, 2025
Last Modified:
September 22nd, 2025
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H