---
id: CVE-2026-8751
title: A security flaw has been discovered in h2oai h2o-3 up to 7402
summary: >-
  A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects
  the function importBinaryModel of the file
  h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing
  a manipulation results in deserializati…
severity: high
cvss: 7.3
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'
cwe:
  - CWE-20
  - CWE-502
vendor: h2o
product: h2o
affected:
  - h2o <= 7402
published: '2026-05-17'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T20:10:00.190'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-8751'
references:
  - url: 'https://vuldb.com/submit/810107'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/364378'
    label: cna@vuldb.com
  - url: 'https://vuldb.com/vuln/364378/cti'
    label: cna@vuldb.com
  - url: 'https://vulnplus-note.wetolink.com/share/b5nsQg6EcsBS'
    label: cna@vuldb.com
tags:
  - nvd
epss: 0.0077
epssPercentile: 0.54647
ingestedAt: '2026-10-14T20:53:12.291Z'
---

## Overview

A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

## Affected

- `h2o <= 7402`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.