CVE-2025-10768 h2oai h2o-3 IBMDB2 JDBC Driver ImportSQLTable deserialization
Remote attackers can achieve code execution via unsafe deserialization in the h2o-3 IBMDB2 JDBC Driver ImportSQLTable function.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10768?
CVE-2025-10768 is a medium-severity unsafe deserialization vulnerability in h2oai h2o-3, published on 21 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw has been found in h2oai h2o-3 up to 3.46.08. The impacted element is an unknown function of the file /99/ImportSQLTable of the component IBMDB2 JDBC Driver. This manipulation of the argument connection_url causes deserialization. The attack may be initiated remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-10768?
It affects 1 product.
Products include H2o H2o.
How do I fix CVE-2025-10768?
No fix has been published for CVE-2025-10768 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-10768 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10768 exists.
Other vulnerabilities in h2oai h2o-3
Sources
Also known as GHSA-3qm2-4r9g-fg69.