CVE-2025-10769 h2oai h2o-3 H2 JDBC Driver ImportSQLTable deserialization
Remote attackers can achieve code execution via unsafe deserialization in the H2 JDBC Driver's ImportSQLTable function within the H2O-3 library.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-10769?
CVE-2025-10769 is a medium-severity unsafe deserialization vulnerability in h2oai h2o-3, published on 21 Sep 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A vulnerability has been found in h2oai h2o-3 up to 3.46.08. This affects an unknown function of the file /99/ImportSQLTable of the component H2 JDBC Driver. Such manipulation of the argument connection_url leads to deserialization. The attack may be launched remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
Which versions are affected by CVE-2025-10769?
It affects 1 product.
Products include H2o H2o.
How do I fix CVE-2025-10769?
No fix has been published for CVE-2025-10769 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-10769 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-10769 exists.
Other vulnerabilities in h2oai h2o-3
Sources
Also known as GHSA-9w9w-c98p-vmpv.