Live › vulnerability › CVE-2024-10553
Go to dashboardThe H2O machine learning REST API accepts user-controlled JDBC URLs on two endpoints and passes them to DriverManager.getConnection, which deserializes untrusted data when a MySQL or PostgreSQL driver is on the classpath. An unauthenticated remote attacker can execute arbitrary code on the server.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-27 16:35 UTC, 0h before NVD. All times on this page are UTC.
Teams running the H2O-3 server or the H2O Python or Java packages below 3.46.0.6 that expose the REST API to a network the attacker can reach. Exposure depends on the MySQL or PostgreSQL JDBC driver being on the classpath, which the sources describe as the condition for deserialization.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| h2o | pypi | < 3.46.0.6 | 3.46.0.6 |
| ai.h2o:h2o-core | maven | < 3.46.0.6 | 3.46.0.6 |
| h2o | vendor | = 3.46.0.4 | – |
pip show h2o and compare against 3.46.0.6ai.h2o:h2o-core in the project's build file or mvn dependency:tree and compare against 3.46.0.6POST /99/ImportSQLTable and POST /3/SaveToHiveTable are the attack pathh2o PyPI package to 3.46.0.6 or laterai.h2o:h2o-core Maven artifact to 3.46.0.6 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.46.0.6.
This page as .md · .json · in your agent: get_signal("CVE-2024-10553")
GitHub Advisory Database, CC-BY 4.0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.