H2oai vulnerabilities

Products

• H2oai/h2o-3 23
• H2o-3 8
• H2oai\/h2o-3 2

Newest

• h2oai h2ogpt h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVE-2026-65700 9.3 CriticalJuly 23, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control CVE-2026-8752 6.9 MediumMay 17, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 JAR Model.java importBinaryModel deserialization CVE-2026-8751 6.9 MediumMay 17, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure CVE-2026-8750 6.9 MediumMay 17, 2026
• h2o, h2oai h2oai/h2o-3 +1 more Remote Code Execution in h2oai/h2o-3 CVE-2026-3960 Fix available 5.9 MediumApril 23, 2026
• h2oai h2oai/h2o-3 Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 CVE-2024-5986 9.1 CriticalFebruary 2, 2026
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization CVE-2025-10769 5.3 MediumSeptember 21, 2025
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization CVE-2025-10768 5.3 MediumSeptember 21, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Deserialization Vulnerability in h2oai/h2o-3 CVE-2025-6544 9.8 CriticalSeptember 21, 2025
• h2oai h2oai/h2o-3 Deserialization Vulnerability in h2oai/h2o-3 CVE-2025-5662 9.8 CriticalSeptember 2, 2025
• h2oai h2oai/h2o-3 Deserialization of Untrusted Data in h2oai/h2o-3 CVE-2025-6507 EPSS 17.3% 9.8 CriticalSeptember 1, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service by ReDOS in h2oai/h2o-3 CVE-2024-10549 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service in h2oai/h2o-3 CVE-2024-8062 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service in h2oai/h2o-3 CVE-2024-7768 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 CVE-2024-6863 6.5 MediumMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Arbitrary File Overwrite in h2oai/h2o-3 CVE-2024-8616 8.2 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service by ReDOS in h2oai/h2o-3 CVE-2024-10550 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Arbitrary File Overwrite in h2oai/h2o-3 CVE-2024-6854 7.1 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service and Arbitrary File Write in h2oai/h2o-3 CVE-2024-10572 7.5 HighMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Jdbc Deserialization in h2oai/h2o-3 CVE-2024-10553 Fix available 9.8 CriticalMarch 20, 2025
• h2o, h2oai h2oai/h2o-3 +1 more Denial of Service in h2oai/h2o-3 CVE-2024-7765 7.5 HighMarch 20, 2025
• h2o, h2oai h2o-3 +1 more h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization CVE-2024-8862 Fix available 6.9 MediumSeptember 14, 2024
• h2o, h2oai h2o-3 +1 more H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL CVE-2024-45758 9.1 CriticalSeptember 6, 2024
• h2o, h2oai h2oai/h2o-3, h2oai\/h2o-3 +2 more Denial of Service via Invalid Argument in h2oai/h2o-3 CVE-2024-5979 7.5 HighJune 27, 2024
• h2o, h2oai h2oai/h2o-3, h2oai\/h2o-3 +2 more Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3 CVE-2024-5550 5.3 MediumJune 6, 2024
• h2o, h2oai h2o-3, h2oai/h2o-3 +2 more S3 Bucket Takeover in h2oai/h2o-3 CVE-2024-1456 7.1 HighApril 16, 2024
• h2o, h2oai h2oai/h2o-3 +1 more External Control of File Name or Path in h2oai/h2o-3 CVE-2023-6569 Fix available 9.3 CriticalDecember 14, 2023
• h2o, h2oai h2oai/h2o-3 +1 more H2O Local File Include CVE-2023-6013 9.3 CriticalNovember 16, 2023
• h2o, h2oai h2oai/h2o-3 +1 more H2O S3 Bucket Takeover CVE-2023-6017 8.7 HighNovember 16, 2023
• h2o, h2oai h2oai/h2o-3 +1 more Local File Inclusion in h2oai/h2o-3 CVE-2023-6038 9.3 CriticalNovember 16, 2023
• h2o, h2oai h2oai/h2o-3 +1 more H2O Remote Code Execution via POJO Model Import CVE-2023-6016 EPSS 30.6% 10.0 CriticalNovember 16, 2023