{"id":"CVE-2025-6544","kind":"vulnerability","aliases":["CVE-2025-6544","GHSA-5w3j-gwgh-4rfv"],"related":[],"title":"H2O affected by a deserialization vulnerability","description":"A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.7, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.","summary":"H2O-3 versions up to and including 3.46.0.7 mishandle JDBC connection parameters, so a crafted value can bypass a regular expression check through double URL encoding. An attacker can read arbitrary files on the host and execute arbitrary code.","severity":"critical","cvss":9.8,"epss":0.00919,"exploited":false,"exploited_at":null,"products":[{"name":"ai.h2o:h2o-core","fixed":[],"affected":"<= 3.46.0.7","ecosystem":"maven"},{"name":"h2o","fixed":[],"affected":"<= 3.46.0.7","ecosystem":"pypi"},{"name":"h2o","fixed":[],"affected":">= 3.0.0.2, <= 3.46.0.8","ecosystem":"vendor"}],"ecosystems":["maven","pypi","vendor"],"tags":["cwe-502","h2o","java","package","python","self-hosted"],"not_affected_if":["fixed-version"],"how_to_check":"- Check the installed H2O version: `pip show h2o` for the Python package, or inspect the `ai.h2o:h2o-core` Maven dependency version.\n- Confirm whether an H2O server is reachable from untrusted networks, since the sources do not list a required role or authentication.","fix":"- Upgrade the `h2o` PyPI package and the `ai.h2o:h2o-core` Maven artifact to a version later than `3.46.0.7`; the fixed version is unknown from the sources.\n- Until upgraded, restrict network access to H2O servers.","status":"open","published_at":"2025-09-21T09:15:38+00:00","first_seen_at":"2026-10-27T16:46:06+00:00","triaged_at":"2026-10-27T16:46:11+00:00","updated_at":"2026-10-27T17:03:04+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-27T16:46:11Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `h2o` PyPI package and the `ai.h2o:h2o-core` Maven artifact to a version later than `3.46.0.7`; the fixed version is unknown from the sources.\n- Until upgraded, restrict network access to H2O servers.","reach":"unknown","title":"H2O: JDBC parameter handling lets a request read files and run code","impact":"high","summary":"H2O-3 versions up to and including 3.46.0.7 mishandle JDBC connection parameters, so a crafted value can bypass a regular expression check through double URL encoding. An attacker can read arbitrary files on the host and execute arbitrary code.","category":"package","nicknames":[],"who_cares":["h2o","python","java","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Attacker reads system files and executes arbitrary code on the server","analyst_note":"Confirm the fixed version and whether authentication is required, using the GHSA-5w3j-gwgh-4rfv advisory page.","how_to_check":"- Check the installed H2O version: `pip show h2o` for the Python package, or inspect the `ai.h2o:h2o-core` Maven dependency version.\n- Confirm whether an H2O server is reachable from untrusted networks, since the sources do not list a required role or authentication.","needs_analyst":true,"not_affected_if":["fixed-version"],"who_is_affected":"Teams running H2O-3 servers at or below 3.46.0.7, including through the Python `h2o` package or the Java `h2o-core` artifact, are exposed. The sources say the issue affects all users of the affected versions and do not describe a required non-default setting. Systems that do not run these versions can skip it.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000658,"input_tokens":3415,"output_tokens":633,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-2025':8A,16A '-3':34B '-502':25B '-6544':9A,17A '3.46.0.7':40B,79C '4rfv':14A '5w3j':12A 'affect':2A,122C 'ai.h2o':18A 'allow':80C 'arbitrari':63B,70B,84C,89C 'aris':93C 'attack':60B,81C 'bypass':50B,106C 'check':54B,109C 'code':71B,90C 'connect':43B,99C 'core':21A 'craft':47B 'cve':7A,15A 'cwe':24B 'deseri':5A,73C 'doubl':56B,112C 'encod':58B,114C 'execut':69B,88C 'exist':75C 'exploit':104C 'express':53B,108C 'file':64B,86C 'ghsa':11A 'ghsa-5w3j-gwgh-4rfv':10A 'gwgh':13A 'h2o':1A,20A,22A,23A,26B,33B 'h2o-core':19A 'h2oai/h2o-3':77C 'handl':96C 'host':32B,67B 'impact':117C 'improp':95C 'includ':39B 'issu':116C 'java':27B 'jdbc':42B,98C 'mishandl':41B 'packag':28B 'paramet':44B,100C 'python':29B 'read':62B,83C 'regular':52B,107C 'self':31B 'self-host':30B 'system':85C 'url':57B,113C 'use':111C 'user':119C 'valu':48B 'version':35B,78C,123C 'vulner':6A,74C,92C","nicknames":[],"mitigations":[],"who_affected":"Teams running H2O-3 servers at or below 3.46.0.7, including through the Python `h2o` package or the Java `h2o-core` artifact, are exposed. The sources say the issue affects all users of the affected versions and do not describe a required non-default setting. Systems that do not run these versions can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2025-09-21T09:15:38+00:00","kev":null,"cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"GitHub","poc_count":0,"sources":[{"source":"ghsa","external_id":"GHSA-5w3j-gwgh-4rfv","url":"https://github.com/advisories/GHSA-5w3j-gwgh-4rfv","severity":"critical","published_at":"2025-09-22T18:30:34+00:00","modified_at":"2026-10-27T16:41:33+00:00","first_seen_at":"2026-10-27T16:46:06+00:00","fetched_at":"2026-10-27T16:46:06+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-6544","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-6544","severity":null,"published_at":"2025-09-21T09:15:38+00:00","modified_at":"2026-10-05T14:10:00+00:00","first_seen_at":"2026-10-27T17:03:04+00:00","fetched_at":"2026-10-27T17:03:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}