H2
Vendor
h2o
37
CVEs
0
On KEV
0
New 30D
Products
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-45271 | PI picotls h2o | 5.5 | Aug 21 | picotls has infinite recursion in the minicrypto ASN.1 decoder |
| CVE-2026-54340 | H2 h2o h2o | 7.5 | Jul 16 | h2o has HTTP/2 state amplification |
| CVE-2026-44453 | H2 h2o h2o | 7.5 | Jul 16 | h2o is vulnerable to musl libc stack overflow |
| CVE-2026-44452 | H2 h2o h2o | 5.9 | Jul 16 | h2o is vulnerable to heap overrun |
| CVE-2026-44436 | QU quicly h2o | 7.5 | Jul 16 | Quicly is vulnerable to connection state corruption |
| CVE-2026-44435 | QU quicly h2o | 7.5 | Jul 16 | Quicly: Remote Denial of Service via assertion failure when CRYPTO stream handshake data exceeds 32KB |
| CVE-2026-44434 | QU quicly h2o | 5.3 | Jul 16 | Quicly is vulnerable to stateless reset injection |
| CVE-2026-44433 | QU quicly h2o | 7.5 | Jul 16 | Quicly is vulnerable to memory exhaustion |
| CVE-2026-55213 | H2 h2o h2o | 7.5 | Jul 10 | h2o: musl libc stack overflow (QPACK) |
| CVE-2026-8752 | H2 H2o H2o | 5.3 | May 17 | h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control |
| CVE-2026-8751 | H2 H2o H2o | 9.8 | May 17 | h2oai h2o-3 JAR Model.java importBinaryModel deserialization |
| CVE-2026-8750 | H2 H2o H2o | 7.5 | May 17 | h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure |
| CVE-2026-3960 | H2 H2o H2o | 9.8 | Apr 23 | Remote Code Execution in h2oai/h2o-3 |
| CVE-2025-61684 | QU quicly h2o | 7.5 | Jan 19 | Quicly has assertion failures |
| CVE-2025-10769 | H2 H2o H2o | 9.8 | Sep 21 | h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization |
| CVE-2025-10768 | H2 H2o H2o | 9.8 | Sep 21 | h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization |
| CVE-2025-6544 | H2 H2o H2o | 9.8 | Sep 21 | Deserialization Vulnerability in h2oai/h2o-3 |
| CVE-2024-10549 | H2 H2o H2o | 7.5 | Mar 20 | Denial of Service by ReDOS in h2oai/h2o-3 |
| CVE-2024-8062 | H2 H2o H2o | 7.5 | Mar 20 | Denial of Service in h2oai/h2o-3 |
| CVE-2024-7768 | H2 H2o H2o | 7.5 | Mar 20 | Denial of Service in h2oai/h2o-3 |
| CVE-2024-6863 | H2 H2o H2o | 6.5 | Mar 20 | Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 |
| CVE-2024-8616 | H2 H2o H2o | 8.2 | Mar 20 | Arbitrary File Overwrite in h2oai/h2o-3 |
| CVE-2024-10550 | H2 H2o H2o | 7.5 | Mar 20 | Denial of Service by ReDOS in h2oai/h2o-3 |
| CVE-2024-6854 | H2 H2o H2o | 7.1 | Mar 20 | Arbitrary File Overwrite in h2oai/h2o-3 |
| CVE-2024-10572 | H2 H2o H2o | 7.5 | Mar 20 | Denial of Service and Arbitrary File Write in h2oai/h2o-3 |
| CVE-2024-10553 | H2 H2o H2o | 9.8 | Mar 20 | Jdbc Deserialization in h2oai/h2o-3 |
| CVE-2024-7765 | H2 H2o H2o | 7.5 | Mar 20 | Denial of Service in h2oai/h2o-3 |
| CVE-2024-8862 | H2 H2o H2o | 9.8 | Sep 14 | A vulnerability, which was classified as critical, has been found in h2oai h2o-3 3.46.0.4 |
| CVE-2024-45758 | H2 H2o H2o | 9.1 | Sep 6 | H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution |
| CVE-2024-5979 | H2 H2o H2o | 7.5 | Jun 27 | In h2oai/h2o-3 version 3.46.0, the `run_tool` command in the `rapids` component allows the `main` function of any class under the `water.tools` namespace to be called |
| CVE-2024-5550 | H2 H2o H2o | 5.3 | Jun 6 | In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature |
| CVE-2024-1456 | H2 H2o H2o | 7.1 | Apr 16 | An S3 bucket takeover vulnerability was identified in the h2oai/h2o-3 repository |
| CVE-2023-6569 | H2 H2o H2o | 8.2 | Dec 14 | External Control of File Name or Path in h2oai/h2o-3 |
| CVE-2023-6038 | H2 H2o H2o | 7.5 | Nov 16 | A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of… |
| CVE-2023-6017 | H2 H2o H2o | 7.1 | Nov 16 | H2O included a reference to an S3 bucket that no longer existed allowing an attacker to take over the S3 bucket URL |
| CVE-2023-6013 | H2 H2o H2o | 5.4 | Nov 16 | H2O is vulnerable to stored XSS vulnerability which can lead to a Local File Include attack |
| CVE-2023-6016 | H2 H2o H2o | 9.8 | Nov 16 | An attacker is able to gain remote code execution on a server hosting the H2O dashboard through it's POJO model import feature |