CVE-2025-10768: h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connectionurl causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10768?
CVE-2025-10768 has a medium severity rating, indicating potential impact on confidentiality and integrity.
How does CVE-2025-10768 manifest?
CVE-2025-10768 manifests through deserialization vulnerabilities triggered by manipulation of the connection_url argument in the IBM DB2 JDBC Driver.
Which versions are affected by CVE-2025-10768?
CVE-2025-10768 affects h2oai h2o-3 versions up to and including 3.46.08.
How can I mitigate the risks associated with CVE-2025-10768?
To mitigate CVE-2025-10768, it is recommended to update to a version of h2oai h2o-3 that is later than 3.46.08.
Can CVE-2025-10768 be exploited remotely?
Yes, CVE-2025-10768 can be exploited remotely, making it critical to apply necessary security measures.