h2oai h2o-3 JAR Model.java importBinaryModel deserialization

Remote Code Execution in h2oai/h2o-3

h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization

h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization

Deserialization Vulnerability in h2oai/h2o-3

Jdbc Deserialization in h2oai/h2o-3

h2oai h2o-3 JDBC Connection 1 getConnectionSafe deserialization

H2O Remote Code Execution via POJO Model Import

H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command execution

Arbitrary File Overwrite in h2oai/h2o-3

External Control of File Name or Path in h2oai/h2o-3

h2o has HTTP/2 state amplification

h2o is vulnerable to musl libc stack overflow

h2o: musl libc stack overflow (QPACK)

h2oai h2o-3 ImportFile API PersistNFS.java importFiles information disclosure

Denial of Service by ReDOS in h2oai/h2o-3

Denial of Service in h2oai/h2o-3

Denial of Service in h2oai/h2o-3

Denial of Service by ReDOS in h2oai/h2o-3

Denial of Service and Arbitrary File Write in h2oai/h2o-3

Denial of Service in h2oai/h2o-3

H2O assertion failure when HTTP/3 requests are cancelled

H2O alllows bypassing address-based access control with 0-RTT

Denial of Service via Invalid Argument in h2oai/h2o-3

h2o QUIC state exhaustion DoS

Local File Inclusion in h2oai/h2o-3

Arbitrary File Overwrite in h2oai/h2o-3

S3 Bucket Takeover in h2oai/h2o-3

H2O S3 Bucket Takeover

h2o vulnerable to TLS session resumption misdirection

Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3

h2o is vulnerable to heap overrun

H2O Local File Include

h2oai h2o-3 Rapids setproperty Primitive AstSetProperty.java exec access control

Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

H2O ignores headers configuration directives