Skip to content
OpenAdvisories

Package · PyPI

h2o

17 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.9
    CVE-2026-3960

    Remote Code Execution in h2oai/h2o-3

    A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 and prior. The vulnerability arises due to insufficient security controls in the parameter blacklist mechanism, which o…

    h2oai h2oai/h2o-3 h2o ai.h2o:h2o-core Maven PyPI
  • Medium 6.5
    CVE-2024-6863

    Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3

    In h2oai/h2o-3 version 3.46.0, an endpoint exposing a custom EncryptionTool allows an attacker to encrypt any files on the target server with a key of their choosing. The chosen key can also be overwritten, resulting in ransomware-like behavior. This vulnerab…

    h2oai h2oai/h2o-3 h2o ai.h2o:h2o-core Maven PyPI
  • Medium 5.3
    CVE-2024-5550

    Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

    In h2oai/h2o-3 version 3.40.0.4, an exposure of sensitive information vulnerability exists due to an arbitrary system path lookup feature. This vulnerability allows any remote user to view full paths in the entire file system where h2o-3 is hosted. Specifical…

    h2oai h2oai/h2o-3 h2o PyPI