Critical severityNVD Advisory· Published Sep 21, 2025· Updated Sep 22, 2025
Deserialization Vulnerability in h2oai/h2o-3
CVE-2025-6544
Description
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ai.h2o:h2o-coreMaven | <= 3.46.0.7 | — |
h2oPyPI | <= 3.46.0.7 | — |
Affected products
3- ghsa-coords2 versions
<= 3.46.0.7+ 1 more
- (no CPE)range: <= 3.46.0.7
- (no CPE)range: <= 3.46.0.7
Patches
Vulnerability mechanics
References
4News mentions
0No linked articles in our index yet.