Vulnerabilities for h2o

No release of h2o is currently known to be free of vulnerabilities.

Details

• PYSEC-2026-21802026-04-23

  A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which only targets MySQL JDBC driver-specific dangerous parameters. An attacker can bypass these controls by switching the JDBC URL protocol to jdbc:postgresql: and exploiting PostgreSQL JDBC driver-specific parameters such as socketFactory and socketFactoryArg. This allows unauthenticated attackers to execute arbitrary code on the H2O-3 server with the privileges of the H2O-3 process. The issue is resolved in version 3.46.0.10.

  Fixed in: 3.46.0.10

• GHSA-wj3h-wx8g-x6992026-02-02

  H2O has an External Control of File Name or Path vulnerability

• GHSA-5w3j-gwgh-4rfv2025-09-22

  H2O affected by a deserialization vulnerability

• GHSA-g48v-3p35-88jr2025-03-20

  H2O Vulnerable to Arbitrary File Overwrite

• GHSA-5c8j-g96x-cj782025-03-20

  H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

• GHSA-6w62-3jvj-mfj62025-03-20

  H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

• GHSA-p2vc-m5fv-9w9m2025-03-20

  H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

• GHSA-47f6-5p7h-5f3h2025-03-20

  H2O Vulnerable to Arbitrary File Overwrite via File Export

• GHSA-m37h-8r48-2cxj2025-03-20

  H2O Vulnerable to Execution of Arbitrary Files

• GHSA-7qq7-pvm9-x8rf2025-03-20

  H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

• GHSA-h7xg-cmpp-48hf2025-03-20

  H2O Deserialization of Untrusted Data Vulnerability

  Fixed in: 3.46.0.6

• GHSA-wjpv-64v2-2qpq2025-03-20

  H2O Vulnerable to Denial of Service (DoS) and File Write

• GHSA-wwr9-4gmr-xvq92025-03-20

  H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

• GHSA-hrmc-jmp7-mpm22024-09-06

  H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL

• GHSA-58m3-rcvp-f9ww2024-06-27

  h2o vulnerable to unexpected POST request shutting down server

• GHSA-x234-r5fg-x52m2024-06-06

  Arbitrary system path lookup in h20

• GHSA-gqrq-j6pm-98c22023-12-14

  External Control of File Name or Path in h2oai/h2o-3

  Fixed in: 3.46.0.1