---
id: "CVE-2025-6544"
kind: "vulnerability"
aliases: ["CVE-2025-6544", "GHSA-5w3j-gwgh-4rfv"]
title: "H2O affected by a deserialization vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.00919
exploited: false
status: "open"
category: "package"
products: [{"name": "ai.h2o:h2o-core", "fixed": [], "affected": "<= 3.46.0.7", "ecosystem": "maven"}, {"name": "h2o", "fixed": [], "affected": "<= 3.46.0.7", "ecosystem": "pypi"}, {"name": "h2o", "fixed": [], "affected": ">= 3.0.0.2, <= 3.46.0.8", "ecosystem": "vendor"}]
ecosystems: ["maven", "pypi", "vendor"]
tags: ["cwe-502", "h2o", "java", "package", "python", "self-hosted"]
not_affected_if: ["fixed-version"]
published_at: "2025-09-21T09:15:38+00:00"
first_seen_at: "2026-10-27T16:46:06+00:00"
updated_at: "2026-10-27T17:03:04+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-5w3j-gwgh-4rfv", "first_seen_at": "2026-10-27T16:46:06+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6544", "first_seen_at": "2026-10-27T17:03:04+00:00"}]
---

# H2O affected by a deserialization vulnerability

H2O-3 versions up to and including 3.46.0.7 mishandle JDBC connection parameters, so a crafted value can bypass a regular expression check through double URL encoding. An attacker can read arbitrary files on the host and execute arbitrary code.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- maven:ai.h2o:h2o-core affected <= 3.46.0.7 fixed ?
- pypi:h2o affected <= 3.46.0.7 fixed ?
- vendor:h2o affected >= 3.0.0.2, <= 3.46.0.8 fixed ?

## How to check

- Check the installed H2O version: `pip show h2o` for the Python package, or inspect the `ai.h2o:h2o-core` Maven dependency version.
- Confirm whether an H2O server is reachable from untrusted networks, since the sources do not list a required role or authentication.

## Fix

- Upgrade the `h2o` PyPI package and the `ai.h2o:h2o-core` Maven artifact to a version later than `3.46.0.7`; the fixed version is unknown from the sources.
- Until upgraded, restrict network access to H2O servers.

## Timeline

- 2026-10-27T16:46:06+00:00 ghsa https://github.com/advisories/GHSA-5w3j-gwgh-4rfv
- 2026-10-27T17:03:04+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2025-6544

## From the sources

A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.7, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_