H2Oai H2O 3 vulnerabilities
6 vulnerabilities
Known vulnerabilities in H2Oai H2O 3, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
RoutineCVE-2026-8752h2oai · h2o-3 +1 moreh2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access controlA weakness has been identified in h2oai h2o-3 up to 7402. This vulnerability affects the function exec of the file h2o-core/src/main/java/water/rapids/ast/prims/misc/AstSetProperty.java of the component Rapids setproperty Primitive Handler. Executing a manipulation can lead to improper access controls. The attack may be performed from remote. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVSS6.9MediumEPSS0.31%RoutineCVE-2026-8751h2oai · h2o-3 +1 moreh2oai h2o-3 JAR Model.java importBinaryModel deserializationA security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS0.41%RoutineCVE-2026-8750h2oai · h2o-3 +1 moreh2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosureA vulnerability was identified in h2oai h2o-3 up to 7402. Affected by this issue is the function importFiles of the file h2o-core/src/main/java/water/persist/PersistNFS.java of the component ImportFile API. Such manipulation leads to information disclosure. The attack can be executed remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS7.5HighEPSS0.50%RoutineCVE-2025-10769h2oai · h2o-3 +1 moreh2oai h2o-3 H2 JDBC Driver ImportSQLTable deserializationA vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS0.54%RoutineCVE-2025-10768h2oai · h2o-3 +1 moreh2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserializationA flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS0.44%RoutineCVE-2024-8862h2oai · h2o-3 +2 moreh2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationA vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4. This issue affects the function getConnectionSafe of the file /dtale/chart-data/1 of the component JDBC Connection Handler. The manipulation of the argument query leads to deserialization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.CVSS9.8CriticalEPSS1.33%