Critical severity · published Sep 21, 2025
CVE-2025-10769
h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
9.8
CVSS
0.5%
EPSS
No
On KEV
Description
A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 45% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
H2
h2o-3 · h2oai
3.46.08 · source: vendor
H2
H2o · H2o
3.0.0.2 through 3.46.0.8 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2025-10769
CVE.org
https://www.cve.org/CVERecord?id=CVE-2025-10769
Broken Link
https://github.com/ez-lbz/poc/issues/51
Broken Link
https://github.com/ez-lbz/poc/issues/51#issue-3391023368
Exploit
https://huntr.com/bounties/4066ce21-7148-44f5-8336-b1674c2f588d
Permissions Required
https://vuldb.com/?ctiid.325125
Third Party Advisory
https://vuldb.com/?id.325125
Third Party Advisory
https://vuldb.com/?submit.649728
More from h2o-3
9.8
CVE-2026-8751
h2oai h2o-3 JAR Model.java importBinaryModel deserialization
9.8
CVE-2025-10768
h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
9.1
CVE-2024-45758
H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution
7.5
CVE-2026-8750
h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure
5.3
CVE-2026-8752
h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control