H2O Deserialization of Untrusted Data Vulnerability

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2024-10553 · ADVISORY
• h2oai/h2o-3 commit ac1d642 · WEB
• h2oai/h2o-3 · PACKAGE
• pypa/advisory-database · WEB
• huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b · WEB
• pypi.org/project/h2o · WEB
• GitHub Advisory GHSA-h7xg-cmpp-48hf · ADVISORY

ai.h2o:h2o-core のその他の脆弱性

• CVE-2026-3960緊急 9.8A critical remote code execution vulnerability exists in the unauthenticated REST API endpoint /99/ImportSQLTable in H2O-3 version 3.46.0.9 …
• CVE-2024-5986緊急 9.1A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved …
• CVE-2025-6544緊急 9.8A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute ar…
• CVE-2024-8616高 8.2In h2oai/h2o-3 version 3.46.0, the `/99/Models/{name}/json` endpoint allows for arbitrary file overwrite on the target server. The vulnerabi…
• CVE-2024-8062高 7.5A vulnerability in the typeahead endpoint of h2oai/h2o-3 version 3.46.0 allows for a denial of service. The endpoint performs a `HEAD` reque…