PT-2025-38661 · H2O.Ai · H2O-3

Published 2025-06-23 · Updated 2026-05-22 · CVE-2025-6544

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions h2oai/h2o-3 versions 3.46.0.8 and earlier

Description A deserialization issue exists in h2oai/h2o-3 versions 3.46.0.8 and earlier, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability is due to improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Deserialization of Untrusted Data

Weakness Enumeration

CWE-502

Related Identifiers

BDU:2025-11489

CVE-2025-6544

GHSA-5W3J-GWGH-4RFV

Affected Products

H2O-3

References · 12

• 🔥 https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40 · Exploit
• https://github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-6544 · Security Note
• https://bdu.fstec.ru/vul/2025-11489 · Security Note
• https://osv.dev/vulnerability/CVE-2025-6544 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5w3j-gwgh-4rfv · Vendor Advisory
• https://github.com/h2oai/h2o-3 · Note
• https://twitter.com/CVEnew/status/1969695309279244401 · Twitter Post
• https://twitter.com/HugoValters/status/2057929371004829790 · Twitter Post
• https://t.me/CVEtracker/33010 · Telegram Post
• https://twitter.com/CveFindCom/status/1969690364672897364 · Twitter Post
• https://twitter.com/offseq/status/1969937488627057101 · Twitter Post