Deserialization Vulnerability in H2O.ai's H2O-3 Product

CVE-2025-6507

What is CVE-2025-6507?

A vulnerability in H2O.ai's H2O-3 allows attackers to exploit deserialization of untrusted data, which may lead to unauthorized file access and arbitrary code execution. This security issue stems from the failure of regular expression filters designed to prevent malicious parameter injection in JDBC connections. Attackers can manipulate whitespace between parameters to bypass these detections, making it possible to execute arbitrary commands or access sensitive system files. The vulnerability has been addressed in the previous version 3.46.0.8.

References