# ai.h2o:h2o-core (Maven) vulnerabilities 15 known vulnerabilities (5 critical, 8 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.46.0.12 (Aug 11, 2026): affected by CVE-2024-7768 - Newest unaffected release: Every release is affected by at least one advisory - Dependents: 22 - Releases: 258 since 0.1.3 (Aug 1, 2014) - Registry: https://central.sonatype.com/artifact/ai.h2o/h2o-core - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-3960: 0.1.3 to 3.46.0.9 (3.46.0.10 is outside it) - CVE-2024-5986: 0.1.3 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2025-6544: 0.1.3 to 3.46.0.7 (3.46.0.8 is outside it) - CVE-2024-10549: 3.30.0.7 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2024-8062: 3.2.0.1 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-7768: 0.1.3 to 3.46.0.12 (through the newest release) - CVE-2024-6863: 3.32.1.2 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-8616: 3.10.4.1 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-10550: 3.30.0.7 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2024-6854: 3.32.1.1 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-10553: 0.1.3 to 3.46.0.5 (3.46.0.6 is outside it) - CVE-2024-7765: 3.32.1.2 to 3.46.0.2 (3.46.0.3 is outside it) - CVE-2024-45758: 0.1.3 to 3.46.0.7 (3.46.0.8 is outside it) - CVE-2024-6960: 0.1.3 to 3.46.0.4 (3.46.0.5 is outside it) - CVE-2023-6038: 0.1.3 to 3.40.0.4 (3.42.0.1 is outside it) ## Advisories (15) ### [CVE-2026-3960](https://cve.now/CVE-2026-3960): Remote Code Execution in h2oai/h2o-3 - Severity: Medium 5.9 - Published: Apr 23, 2026 - Affected: fixed in 3.46.0.10. - Fixed in 3.46.0.10 (released Mar 12, 2026, 42 days before disclosure). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-5986](https://cve.now/CVE-2024-5986): Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 - Severity: Critical 9.1 - Published: Feb 2, 2026 - Affected: through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 630 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2025-6544](https://cve.now/CVE-2025-6544): Deserialization Vulnerability in h2oai/h2o-3 - Severity: Critical 9.8 - Published: Sep 21, 2025 - Affected: through 3.46.0.7. - Fixed in 3.46.0.8 (released Oct 8, 2025, 17 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10549](https://cve.now/CVE-2024-10549): Denial of Service by ReDOS in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.30.0.7, through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-8062](https://cve.now/CVE-2024-8062): Denial of Service in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.2.0.1, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 13, 2024, 372 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-7768](https://cve.now/CVE-2024-7768): Denial of Service in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: through 3.46.1. - No fix released. The latest release, 3.46.0.12, is still affected. ### [CVE-2024-6863](https://cve.now/CVE-2024-6863): Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 - Severity: Medium 6.5 - Published: Mar 20, 2025 - Affected: from 3.32.1.2, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 13, 2024, 372 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-8616](https://cve.now/CVE-2024-8616): Arbitrary File Overwrite in h2oai/h2o-3 - Severity: High 8.2 - Published: Mar 20, 2025 - Affected: from 3.10.4.1, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 13, 2024, 372 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10550](https://cve.now/CVE-2024-10550): Denial of Service by ReDOS in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.30.0.7, through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-6854](https://cve.now/CVE-2024-6854): Arbitrary File Overwrite in h2oai/h2o-3 - Severity: High 7.1 - Published: Mar 20, 2025 - Affected: from 3.32.1.1, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 13, 2024, 372 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10553](https://cve.now/CVE-2024-10553): Jdbc Deserialization in h2oai/h2o-3 - Severity: Critical 9.8 - Published: Mar 20, 2025 - Affected: fixed in 3.46.0.6. - Fixed in 3.46.0.6 (released Nov 2, 2024, 138 days before disclosure). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-7765](https://cve.now/CVE-2024-7765): Denial of Service in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.32.1.2, through 3.46.0.2. - Fixed in 3.46.0.3 (released Jun 11, 2024, 282 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-45758](https://cve.now/CVE-2024-45758): H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command… - Severity: Critical 9.1 - Published: Sep 6, 2024 - Affected: through 3.46.0.7. - Fixed in 3.46.0.8 (released Oct 8, 2025, 397 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-6960](https://cve.now/CVE-2024-6960): H2O deserializes ML models without filtering, potentially allowing execution of malicious code - Severity: High 7.5 - Published: Jul 21, 2024 - Affected: through 3.46.0.4. - Fixed in 3.46.0.5 (released Aug 29, 2024, 39 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2023-6038](https://cve.now/CVE-2023-6038): Local File Inclusion in h2oai/h2o-3 - Severity: Critical 9.3 - Published: Nov 16, 2023 - Affected: through 3.40.0.4. - Fixed in 3.42.0.1 (released Jun 20, 2023, 149 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/ai.h2o:h2o-core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.