Advisoriesby Ibis
H2O-3 security advisories
17 advisories · 2 critical or high in 12 months · latest Apr 23
17 advisories
H2O-3: remote code executionCVE-2026-3960fixed in 3.46.0.10H2O has an External Control of File Name or Path vulnerabilityCVE-2024-5986no fix yetH2O affected by a deserialization vulnerabilityCVE-2025-6544no fix yetH2O Vulnerable to Arbitrary File OverwriteCVE-2024-8616no fix yetH2O Vulnerable to Denial of Service (DoS) via `HEAD` RequestCVE-2024-8062no fix yetH2O Vulnerable to Denial of Service (DoS) via Large GZIP ParsingCVE-2024-7765no fix yetH2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` EndpointCVE-2024-7768no fix yetH2O Vulnerable to Arbitrary File Overwrite via File ExportCVE-2024-6854no fix yetH2O Vulnerable to Execution of Arbitrary FilesCVE-2024-6863no fix yetH2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` EndpointCVE-2024-10550no fix yetH2O Deserialization of Untrusted Data VulnerabilityCVE-2024-10553fixed in 3.46.0.6H2O Vulnerable to Denial of Service (DoS) and File WriteCVE-2024-10572no fix yetH2O Vulnerable to Denial of Service (DoS) via `/3/Parse` EndpointCVE-2024-10549no fix yetH2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URLCVE-2024-45758no fix yeth2o vulnerable to unexpected POST request shutting down serverCVE-2024-5979no fix yetArbitrary system path lookup in h20CVE-2024-5550no fix yetExternal Control of File Name or Path in h2oai/h2o-3CVE-2023-6569fixed in 3.46.0.1