h2o records

35 published records for vendor h2o.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 7
With a fix record: 11.4%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

35 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
48Plan	CVE-2023-6016No exploit	H2O Remote Code Execution via POJO Model Importh2o · h2o · CWE-94 pre-auth RCE	Critical9.8	—	30.5%	Nov 16, 2023
39Monitor	CVE-2024-10553No exploit	Jdbc Deserialization in h2oai/h2o-3h2o · h2o · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	1.5%	Mar 20, 2025
39Monitor	CVE-2026-3960No exploit	Remote Code Execution in h2oai/h2o-3h2o · h2o · CWE-94 pre-auth RCE	Critical9.8	—	0.9%	Apr 23, 2026
39Monitor	CVE-2025-6544No exploit	Deserialization Vulnerability in h2oai/h2o-3h2o · h2o · CWE-502 pre-auth RCE Deserialization	Critical9.8	—	0.9%	Sep 21, 2025
36Monitor	CVE-2024-45758No exploit	H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command exh2o · h2o · CWE-502 pre-auth RCE Deserialization	Critical9.1	—	0.9%	Sep 6, 2024
32Monitor	CVE-2023-6569No exploit	External Control of File Name or Path in h2oai/h2o-3h2o · h2o · CWE-73 Pre-auth Path traversal	High8.2	—	0.7%	Dec 14, 2023
32Monitor	CVE-2024-8616No exploit	Arbitrary File Overwrite in h2oai/h2o-3h2o · h2o · CWE-73 Pre-auth Path traversal	High8.2	—	0.5%	Mar 20, 2025
31Monitor	CVE-2023-6038Proof of concept	Local File Inclusion in h2oai/h2o-3h2o · h2o · CWE-862 Pre-auth Broken access control (IDOR)	High7.5	—	4.3%	Nov 16, 2023
30Monitor	CVE-2024-5979No exploit	Denial of Service via Invalid Argument in h2oai/h2o-3h2o · h2o · CWE-94 pre-auth RCE Denial of service	High7.5	—	0.7%	Jun 27, 2024
30Monitor	CVE-2024-7768No exploit	Denial of Service in h2oai/h2o-3h2o · h2o · CWE-770 Pre-auth Denial of service	High7.5	—	0.7%	Mar 20, 2025
30Monitor	CVE-2024-7765No exploit	Denial of Service in h2oai/h2o-3h2o · h2o · CWE-409 Pre-auth Denial of service	High7.5	—	0.7%	Mar 20, 2025
30Monitor	CVE-2024-10572No exploit	Denial of Service and Arbitrary File Write in h2oai/h2o-3h2o · h2o · CWE-94 pre-auth RCE Denial of service	High7.5	—	0.6%	Mar 20, 2025
30Monitor	CVE-2024-10550No exploit	Denial of Service by ReDOS in h2oai/h2o-3h2o · h2o · CWE-1333 Pre-auth Denial of service	High7.5	—	0.6%	Mar 20, 2025
30Monitor	CVE-2024-10549No exploit	Denial of Service by ReDOS in h2oai/h2o-3h2o · h2o · CWE-1333 Pre-auth Denial of service	High7.5	—	0.6%	Mar 20, 2025
30Monitor	CVE-2026-54340No exploit	h2o has HTTP/2 state amplificationh2o · h2o · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Jul 16, 2026
30Monitor	CVE-2026-44436No exploit	Quicly is vulnerable to connection state corruptionh2o · quicly · CWE-120 Pre-auth Memory safety Denial of service	High7.5	—	0.4%	Jul 16, 2026
30Monitor	CVE-2026-44435No exploit	Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KBh2o · quicly · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Jul 16, 2026
30Monitor	CVE-2026-44433No exploit	Quicly is vulnerable to memory exhaustionh2o · quicly · CWE-400 Pre-auth Denial of service	High7.5	—	0.4%	Jul 16, 2026
30Monitor	CVE-2026-44453No exploit	h2o is vulnerable to musl libc stack overflowh2o · h2o · CWE-770 Pre-auth Denial of service	High7.5	—	0.4%	Jul 16, 2026
30Monitor	CVE-2024-8062No exploit	Denial of Service in h2oai/h2o-3h2o · h2o · CWE-1088 Pre-auth Denial of service	High7.5	—	0.4%	Mar 20, 2025
30Monitor	CVE-2025-61684No exploit	Quicly has assertion failuresh2o · quicly · CWE-20 Pre-auth Denial of service	High7.5	—	0.3%	Jan 19, 2026
28Monitor	CVE-2023-6017No exploit	H2O S3 Bucket Takeoverh2o · h2o · CWE-840	High7.1	—	0.8%	Nov 16, 2023
28Monitor	CVE-2024-6854No exploit	Arbitrary File Overwrite in h2oai/h2o-3h2o · h2o · CWE-36 Path traversal	High7.1	—	0.7%	Mar 20, 2025
28Monitor	CVE-2024-1456No exploit	S3 Bucket Takeover in h2oai/h2o-3h2o · h2o · CWE-840	High7.1	—	0.2%	Apr 15, 2024
27Monitor	CVE-2024-8862No exploit	h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserializationh2o · h2o · CWE-502 Pre-auth Deserialization	Medium6.9	—	1.3%	Sep 14, 2024

CVE-2023-6016
48Plan
H2O Remote Code Execution via POJO Model Import
CriticalCVSS 9.8No exploitEPSS 30%
- pre-auth RCE
h2o · h2oNov 16, 2023
CVE-2024-10553
39Monitor
Jdbc Deserialization in h2oai/h2o-3
CriticalCVSS 9.8No exploitEPSS 1%
- pre-auth RCE
- Deserialization
h2o · h2oMar 20, 2025
CVE-2026-3960
39Monitor
Remote Code Execution in h2oai/h2o-3
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
h2o · h2oApr 23, 2026
CVE-2025-6544
39Monitor
Deserialization Vulnerability in h2oai/h2o-3
CriticalCVSS 9.8No exploitEPSS 0%
- pre-auth RCE
- Deserialization
h2o · h2oSep 21, 2025
CVE-2024-45758
36Monitor
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command ex
CriticalCVSS 9.1No exploitEPSS 0%
- pre-auth RCE
- Deserialization
h2o · h2oSep 6, 2024
CVE-2023-6569
32Monitor
External Control of File Name or Path in h2oai/h2o-3
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
h2o · h2oDec 14, 2023
CVE-2024-8616
32Monitor
Arbitrary File Overwrite in h2oai/h2o-3
HighCVSS 8.2No exploitEPSS 0%
- Pre-auth
- Path traversal
h2o · h2oMar 20, 2025
CVE-2023-6038
31Monitor
Local File Inclusion in h2oai/h2o-3
HighCVSS 7.5Proof of conceptEPSS 4%
- Pre-auth
- Broken access control (IDOR)
h2o · h2oNov 16, 2023
CVE-2024-5979
30Monitor
Denial of Service via Invalid Argument in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Denial of service
h2o · h2oJun 27, 2024
CVE-2024-7768
30Monitor
Denial of Service in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oMar 20, 2025
CVE-2024-7765
30Monitor
Denial of Service in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oMar 20, 2025
CVE-2024-10572
30Monitor
Denial of Service and Arbitrary File Write in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- pre-auth RCE
- Denial of service
h2o · h2oMar 20, 2025
CVE-2024-10550
30Monitor
Denial of Service by ReDOS in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oMar 20, 2025
CVE-2024-10549
30Monitor
Denial of Service by ReDOS in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oMar 20, 2025
CVE-2026-54340
30Monitor
h2o has HTTP/2 state amplification
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oJul 16, 2026
CVE-2026-44436
30Monitor
Quicly is vulnerable to connection state corruption
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Memory safety
- Denial of service
h2o · quiclyJul 16, 2026
CVE-2026-44435
30Monitor
Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · quiclyJul 16, 2026
CVE-2026-44433
30Monitor
Quicly is vulnerable to memory exhaustion
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · quiclyJul 16, 2026
CVE-2026-44453
30Monitor
h2o is vulnerable to musl libc stack overflow
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oJul 16, 2026
CVE-2024-8062
30Monitor
Denial of Service in h2oai/h2o-3
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · h2oMar 20, 2025
CVE-2025-61684
30Monitor
Quicly has assertion failures
HighCVSS 7.5No exploitEPSS 0%
- Pre-auth
- Denial of service
h2o · quiclyJan 19, 2026
CVE-2023-6017
28Monitor
H2O S3 Bucket Takeover
HighCVSS 7.1No exploitEPSS 0%
h2o · h2oNov 16, 2023
CVE-2024-6854
28Monitor
Arbitrary File Overwrite in h2oai/h2o-3
HighCVSS 7.1No exploitEPSS 0%
- Path traversal
h2o · h2oMar 20, 2025
CVE-2024-1456
28Monitor
S3 Bucket Takeover in h2oai/h2o-3
HighCVSS 7.1No exploitEPSS 0%
h2o · h2oApr 15, 2024
CVE-2024-8862
27Monitor
h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization
MediumCVSS 6.9No exploitEPSS 1%
- Pre-auth
- Deserialization
h2o · h2oSep 14, 2024