Skip to main content
cve.nowby Sazabi
← PyPI
PyPIPackage

h2o

17 known vulnerabilities (5 critical, 9 high, 3 medium), with the versions each affects and the releases that fix them.

Latest release
3.46.0.12 (Aug 12, 2026): affected by CVE-2024-7768
Newest unaffected release
Every release is affected by at least one advisory
Advisories
17 · 5 critical, 9 high, 3 medium
Weekly downloads
40.3K
Dependents
27
Releases
123 since 3.10.0.3 (May 25, 2018)
Registry
PyPI
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-3960
    Affects 3.10.0.3 to 3.46.0.9 (3.46.0.10 is outside it)
  • CVE-2024-5986
    Affects 3.10.0.3 to 3.46.0.1 (3.46.0.2 is outside it)
  • CVE-2025-6544
    Affects 3.10.0.3 to 3.46.0.7 (3.46.0.8 is outside it)
  • CVE-2024-10549
    Affects 3.30.0.7 to 3.46.0.1 (3.46.0.2 is outside it)
  • CVE-2024-8062
    Affects 3.10.0.3 to 3.44.0.3 (3.46.0.1 is outside it)
  • CVE-2024-7768
    Affects 3.10.0.3 to 3.46.0.12 (through the newest release)
  • CVE-2024-6863
    Affects 3.32.1.2 to 3.44.0.3 (3.46.0.1 is outside it)
  • CVE-2024-8616
    Affects 3.10.4.1 to 3.44.0.3 (3.46.0.1 is outside it)
  • CVE-2024-10550
    Affects 3.30.0.7 to 3.46.0.1 (3.46.0.2 is outside it)
  • CVE-2024-6854
    Affects 3.32.1.1 to 3.44.0.3 (3.46.0.1 is outside it)
  • CVE-2024-10572
    Affects 3.34.0.3 to 3.46.0.1 (3.46.0.2 is outside it)
  • CVE-2024-10553
    Affects 3.10.0.3 to 3.46.0.5 (3.46.0.6 is outside it)
Show all 17 advisoriesShow fewer advisories
  • CVE-2024-7765
    Affects 3.32.1.2 to 3.46.0.2 (3.46.0.3 is outside it)
  • CVE-2024-45758
    Affects 3.10.0.3 to 3.46.0.7 (3.46.0.8 is outside it)
  • CVE-2024-5979
    Affects 3.10.0.3 to 3.44.0.3 (3.46.0.1 is outside it)
  • CVE-2024-5550
    Affects 3.10.0.3 to 3.40.0.4 (3.42.0.1 is outside it)
  • CVE-2023-6569
    Affects 3.10.0.3 to 3.44.0.3 (3.46.0.1 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 17

  • CVE-2026-3960Medium 5.9

    Remote Code Execution in h2oai/h2o-3

    Affected: fixed in 3.46.0.10.

    Fixed in 3.46.0.10 (released Mar 12, 2026, 42 days before disclosure).

    The latest release, 3.46.0.12, is not affected.

  • CVE-2024-5986Critical 9.1

    Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3

    Affected: through 3.46.0.1.

    Fixed in 3.46.0.2 (released May 13, 2024, 630 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • CVE-2025-6544Critical 9.8

    Deserialization Vulnerability in h2oai/h2o-3

    Affected: through 3.46.0.7.

    Fixed in 3.46.0.8 (released Oct 8, 2025, 17 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service by ReDOS in h2oai/h2o-3

    Affected: from 3.30.0.7, through 3.46.0.1.

    Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service in h2oai/h2o-3

    Affected: from 3.2.0.1, through 3.46.0.

    Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service in h2oai/h2o-3

    Affected: through 3.46.1; through 3.46.1.

    No fix released. The latest release, 3.46.0.12, is still affected.

  • CVE-2024-6863Medium 6.5

    Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3

    Affected: from 3.32.1.2, through 3.46.0.

    Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Arbitrary File Overwrite in h2oai/h2o-3

    Affected: from 3.10.4.1, through 3.46.0.

    Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service by ReDOS in h2oai/h2o-3

    Affected: from 3.30.0.7, through 3.46.0.1.

    Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Arbitrary File Overwrite in h2oai/h2o-3

    Affected: from 3.32.1.1, through 3.46.0.

    Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service and Arbitrary File Write in h2oai/h2o-3

    Affected: from 3.34.0.1, through 3.46.0.1.

    Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • CVE-2024-10553Critical 9.8

    Jdbc Deserialization in h2oai/h2o-3

    Affected: fixed in 3.46.0.6.

    Fixed in 3.46.0.6 (released Nov 2, 2024, 138 days before disclosure).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service in h2oai/h2o-3

    Affected: from 3.32.1.2, through 3.46.0.2.

    Fixed in 3.46.0.3 (released Jun 11, 2024, 282 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • CVE-2024-45758Critical 9.1

    H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command…

    Affected: through 3.46.0.7.

    Fixed in 3.46.0.8 (released Oct 8, 2025, 397 days after disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • Denial of Service via Invalid Argument in h2oai/h2o-3

    Affected: through 3.46.0.

    Fixed in 3.46.0.1 (released Mar 14, 2024, 105 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

Show all 17 advisoriesShow fewer advisories
  • CVE-2024-5550Medium 5.3

    Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3

    Affected: through 3.40.0.4.

    Fixed in 3.42.0.1 (released Jul 5, 2023, 337 days before disclosure), the first release outside every affected range (no listed fixed version clears them all).

    The latest release, 3.46.0.12, is not affected.

  • CVE-2023-6569Critical 9.3

    External Control of File Name or Path in h2oai/h2o-3

    Affected: fixed in 3.46.0.1.

    Fixed in 3.46.0.1 (released Mar 14, 2024, 91 days after disclosure).

    The latest release, 3.46.0.12, is not affected.