H2O-3GHSA-hrmc-jmp7-mpm2
H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL
Critical9.1CVE-2024-45758 · Published Sep 6, 2024 · updated Jun 29, 2026
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution. Exploitation can occur when an attacker has access to post to the ImportSQLTable URI with a JSON document containing a connection_url property with any typical JDBC Connection URL attack payload such as one that uses queryInterceptors.
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| h2o PyPI | <= 3.46.0.7 | No fix yet |
Details and references
- CVSS 3.1
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
- Severity from
- GitHub (reviewed advisory)
- Weakness
- CWE-502
- Also known as
- CVE-2024-45758, PYSEC-2026-352
- nvd.nist.gov/vuln/detail/CVE-2024-45758
- github.com/h2oai/h2o-3/issues/16425
- github.com/h2oai/h2o-3/issues/16622
- github.com/h2oai/h2o-3/pull/16624
- github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d
- gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb
- github.com/h2oai/h2o-3
- spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068
More H2O-3 advisories
All H2O-3| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Mar 202025 | H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint High7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | H2O Vulnerable to Denial of Service (DoS) and File WriteHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Mar 202025 | H2O Deserialization of Untrusted Data VulnerabilityCritical9.8Mar 20, 2025 | Critical9.8 | 3.46.0.6 |
| Mar 202025 | H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` EndpointHigh7.5Mar 20, 2025 | High7.5 | No fix yet |
| Jun 272024 | h2o vulnerable to unexpected POST request shutting down serverHigh7.5Jun 27, 2024 | High7.5 | No fix yet |
| Jun 62024 | Arbitrary system path lookup in h20Medium5.3Jun 6, 2024 | Medium5.3 | No fix yet |