Deserialization Vulnerability in H2O.ai's H2O-3 Product
CVE-2025-6507

9.8CRITICAL

Key Information:

Vendor

H2oai

Status
H2oai/h2o-3
Vendor
CVE Published:
1 September 2025

What is CVE-2025-6507?

A vulnerability in H2O.ai's H2O-3 allows attackers to exploit deserialization of untrusted data, which may lead to unauthorized file access and arbitrary code execution. This security issue stems from the failure of regular expression filters designed to prevent malicious parameter injection in JDBC connections. Attackers can manipulate whitespace between parameters to bypass these detections, making it possible to execute arbitrary commands or access sensitive system files. The vulnerability has been addressed in the previous version 3.46.0.8.

Affected Version(s)

h2oai/h2o-3 < 3.46.0.8

References

https://huntr.com/bounties/0a9d527a-2d39-4bc0-bf01-1e7175...
https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a721...

CVSS V3.0

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-6507 : Deserialization Vulnerability in H2O.ai's H2O-3 Product