CVE-2025-5662 Deserialization Vulnerability in h2oai/h2o-3
Remote attackers can execute arbitrary code via the H2O-3 REST API due to improper validation of JDBC connection parameters.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-5662?
CVE-2025-5662 is a critical unsafe deserialization vulnerability in h2oai/h2o-3, published on 2 Sep 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A deserialization vulnerability exists in the H2O-3 REST API (POST /99/ImportSQLTable) that affects all versions up to 3.46.0.7. This vulnerability allows remote code execution (RCE) due to improper validation of JDBC connection parameters when using a Key-Value format. The vulnerability is present in the MySQL JDBC Driver version 8.0.19 and JDK version 8u112. The issue is resolved in version 3.46.0.8.
Weakness: CWE-502
Which versions are affected by CVE-2025-5662?
How do I fix CVE-2025-5662?
No fix has been published for CVE-2025-5662 yet. Limit exposure of the affected software until one is available.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2025-5662 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-5662 exists.