CVE-2024-10553: H2O Deserialization of Untrusted Data Vulnerability

March 20, 2025 (updated October 27, 2026)

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.46.0.6.

References

github.com/advisories/GHSA-h7xg-cmpp-48hf
github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac
github.com/pypa/advisory-database/tree/main/vulns/h2o/PYSEC-2026-351.yaml
huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b
nvd.nist.gov/vuln/detail/CVE-2024-10553
pypi.org/project/h2o

Code Behaviors & Features

Detect and mitigate CVE-2024-10553 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →