Critical severity9.8NVD Advisory· Published Sep 21, 2025· Updated Jun 17, 2026
CVE-2025-6544
CVE-2025-6544
Description
A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
ai.h2o:h2o-coreMaven | <= 3.46.0.7 | — |
h2oPyPI | <= 3.46.0.7 | — |
Affected products
3- ghsa-coords2 versions
<= 3.46.0.7+ 1 more
- (no CPE)range: <= 3.46.0.7
- (no CPE)range: <= 3.46.0.7
Patches
Vulnerability mechanics
References
4- github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25nvdPatchWEB
- huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40nvdExploitThird Party AdvisoryWEB
- github.com/advisories/GHSA-5w3j-gwgh-4rfvghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2025-6544ghsaADVISORY
News mentions
0No linked articles in our index yet.