Critical · published September 21, 2025
🔥 A double URL encoding trick is all it takes to exploit this critical deserialization vulnerability in h2oai/h2o-3! Imagine ordering a special dish at a restaurant, but instead of following the menu instructions, the chef decides to add whatever they want based on a secret code — that’s what improper parameter handling does here! An attacker could pull off a heist on your system, reading sensitive files and executing arbitrary code — a recipe for chaos that could compromise your entire setup. With all users of affected versions in the crosshairs, this is an urgent wake-up call!
Imagine ordering a special dish at a restaurant, but instead of following the menu instructions, the chef decides to add whatever they want based on a secret code — that’s what improper parameter handling does here! This vulnerability allows attackers to bypass regex checks through double URL encoding, leading to unauthorized access to system files and the execution of malicious code due to improper handling of JDBC connection parameters.
An attacker could pull off a heist on your system, reading sensitive files and executing arbitrary code — a recipe for chaos that could compromise your entire setup. With all users of affected versions in the crosshairs, this is an urgent wake-up call! Update your h2o-3 to version 3.46.0.9 or later immediately. Review your JDBC connection parameters to ensure they are being handled correctly and implement stricter validation checks. Don't take chances — act now! You’ve got this! By following these steps, you'll shield your system from potential disasters. 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| h2o/h2o | ≥ 3.0.0.2, ≤ 3.46.0.8 | — |