Description
A vulnerability in the h2oai/h2o-3 repository allows attackers to exploit deserialization of untrusted data, potentially leading to arbitrary code execution and reading of system files. This issue affects the latest master branch version 3.47.0.99999. The vulnerability arises from the ability to bypass regular expression filters intended to prevent malicious parameter injection in JDBC connections. Attackers can manipulate spaces between parameters to evade detection, allowing for unauthorized file access and code execution. The vulnerability is addressed in version 3.46.0.8.
INFO
Published Date :
2025-09-01T05:10:21.567Z
Last Modified :
2025-09-02T19:29:12.231Z
Source :
@huntr_ai
AFFECTED PRODUCTS
The following products are affected by CVE-2025-6507 vulnerability.
| Vendors | Products |
|---|---|
| H2oai |
|
REFERENCES
Here, you will find a curated list of external links that provide in-depth information to CVE-2025-6507.
