h2o vulnerabilities

CVEs whose affected-version data names the h2o package (pip). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

12 CVEsRSS

CVE-2026-3960Critical· 9.8

5mo ago

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0…

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blackl…

▾ Midnighth2o · h2oEPSS 0.94%via OSV

CVE-2024-10549High· 7.5

1y ago

h2o vulnerabilities

A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0…

H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint

H2O Vulnerable to Denial of Service (DoS) and File Write

H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint

H2O Vulnerable to Execution of Arbitrary Files

H2O Vulnerable to Arbitrary File Overwrite

H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint

H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing

H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request

H2O Vulnerable to Arbitrary File Overwrite via File Export

h2o vulnerable to unexpected POST request shutting down server

Arbitrary system path lookup in h20