CVE-2025-10769: h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connectionurl leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-10769?
CVE-2025-10769 has been classified with a medium severity level due to its ability to allow remote deserialization attacks.
How do I fix CVE-2025-10769?
To fix CVE-2025-10769, update your h2oai h2o-3 installation to version 3.46.09 or later.
What component is affected by CVE-2025-10769?
CVE-2025-10769 affects the H2 JDBC Driver component found in the file /99/ImportSQLTable.
Can CVE-2025-10769 be exploited remotely?
Yes, CVE-2025-10769 can be exploited remotely due to the nature of the vulnerability.
What versions of h2o-3 are affected by CVE-2025-10769?
CVE-2025-10769 affects h2oai h2o-3 up to and including version 3.46.08.