CVE-2025-5662
Critical
Description
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
SeverityCritical
CVSS9.8
Exploit probability53. percentile0.7%
ProductH2oai/h2o-3
PublishedSep 2, 2025
First seenSep 2, 2025
Weakness typeCWE-502Deserialization of untrusted data
How to fix
Update
- h2oai h2oai/h2o-33.46.0.8 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| h2oai h2oai/h2o-3 | v < 3.46.0.8 | 3.46.0.8 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.