Total
30 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2024-1456 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.1 HIGH |
| An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository. The issue involves the S3 bucket 'http://s3.amazonaws.com/h2o-training', which was found to be vulnerable to unauthorized takeover. | |||||
| CVE-2024-10572 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.5 HIGH |
| In h2oai/h2o-3 version 3.46.0.1, the `run_tool` command exposes classes in the `water.tools` package through the `ast` parser. This includes the `XGBoostLibExtractTool` class, which can be exploited to shut down the server and write large files to arbitrary directories, leading to a denial of service. | |||||
| CVE-2024-10553 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 9.8 CRITICAL |
| A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0. | |||||
| CVE-2024-10550 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.5 HIGH |
| A vulnerability in the `/3/ParseSetup` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint applies a user-specified regular expression to a user-controllable string. This can be exploited by an attacker to cause inefficient regular expression complexity, leading to the exhaustion of server resources and making the server unresponsive. | |||||
| CVE-2024-10549 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.5 HIGH |
| A vulnerability in the `/3/Parse` endpoint of h2oai/h2o-3 version 3.46.0.1 allows for a denial of service (DoS) attack. The endpoint uses a user-specified string to construct a regular expression, which is then applied to another user-specified string. By sending multiple simultaneous requests, an attacker can exhaust all available threads, leading to a complete denial of service. | |||||
| CVE-2023-6569 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 8.2 HIGH |
| External Control of File Name or Path in h2oai/h2o-3 | |||||
| CVE-2023-6038 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.5 HIGH |
| A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation and does not require user interaction. The vulnerability can be exploited by making specific GET or POST requests to the ImportFiles and ParseSetup endpoints, respectively. This issue was identified in version 3.40.0.4 of h2o-3. | |||||
| CVE-2023-6017 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 7.1 HIGH |
| H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL. | |||||
| CVE-2023-6016 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 9.8 CRITICAL |
| An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature. | |||||
| CVE-2023-6013 | 1 H2o | 1 H2o | 2026-06-17 | N/A | 5.4 MEDIUM |
| H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack. | |||||