CVE-2025-6544

Published: Sep 21, 2025Modified: Jun 17, 2026

9.8

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: security@huntr.dev (Secondary)

Description

A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.

Affected (1)

Products: H2o: H2o

1 product

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
H2o H2o	From 3.0.0.2 to 3.46.0.8

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (3)

https://github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25

Source: security@huntr.dev

Patch

https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40

Source: security@huntr.dev

ExploitThird Party Advisory

https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

ExploitThird Party Advisory

Timeline

No history available yet.