# h2o (PyPI) vulnerabilities 17 known vulnerabilities (5 critical, 9 high, 3 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 3.46.0.12 (Aug 12, 2026): affected by CVE-2024-7768 - Newest unaffected release: Every release is affected by at least one advisory - Weekly downloads: 40.3K - Dependents: 27 - Releases: 123 since 3.10.0.3 (May 25, 2018) - Registry: https://pypi.org/project/h2o/ - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-3960: 3.10.0.3 to 3.46.0.9 (3.46.0.10 is outside it) - CVE-2024-5986: 3.10.0.3 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2025-6544: 3.10.0.3 to 3.46.0.7 (3.46.0.8 is outside it) - CVE-2024-10549: 3.30.0.7 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2024-8062: 3.10.0.3 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-7768: 3.10.0.3 to 3.46.0.12 (through the newest release) - CVE-2024-6863: 3.32.1.2 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-8616: 3.10.4.1 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-10550: 3.30.0.7 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2024-6854: 3.32.1.1 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-10572: 3.34.0.3 to 3.46.0.1 (3.46.0.2 is outside it) - CVE-2024-10553: 3.10.0.3 to 3.46.0.5 (3.46.0.6 is outside it) - CVE-2024-7765: 3.32.1.2 to 3.46.0.2 (3.46.0.3 is outside it) - CVE-2024-45758: 3.10.0.3 to 3.46.0.7 (3.46.0.8 is outside it) - CVE-2024-5979: 3.10.0.3 to 3.44.0.3 (3.46.0.1 is outside it) - CVE-2024-5550: 3.10.0.3 to 3.40.0.4 (3.42.0.1 is outside it) - CVE-2023-6569: 3.10.0.3 to 3.44.0.3 (3.46.0.1 is outside it) ## Advisories (17) ### [CVE-2026-3960](https://cve.now/CVE-2026-3960): Remote Code Execution in h2oai/h2o-3 - Severity: Medium 5.9 - Published: Apr 23, 2026 - Affected: fixed in 3.46.0.10. - Fixed in 3.46.0.10 (released Mar 12, 2026, 42 days before disclosure). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-5986](https://cve.now/CVE-2024-5986): Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3 - Severity: Critical 9.1 - Published: Feb 2, 2026 - Affected: through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 630 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2025-6544](https://cve.now/CVE-2025-6544): Deserialization Vulnerability in h2oai/h2o-3 - Severity: Critical 9.8 - Published: Sep 21, 2025 - Affected: through 3.46.0.7. - Fixed in 3.46.0.8 (released Oct 8, 2025, 17 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10549](https://cve.now/CVE-2024-10549): Denial of Service by ReDOS in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.30.0.7, through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-8062](https://cve.now/CVE-2024-8062): Denial of Service in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.2.0.1, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-7768](https://cve.now/CVE-2024-7768): Denial of Service in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: through 3.46.1; through 3.46.1. - No fix released. The latest release, 3.46.0.12, is still affected. ### [CVE-2024-6863](https://cve.now/CVE-2024-6863): Encryption of Arbitrary Files with Attacker-Controlled Key in h2oai/h2o-3 - Severity: Medium 6.5 - Published: Mar 20, 2025 - Affected: from 3.32.1.2, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-8616](https://cve.now/CVE-2024-8616): Arbitrary File Overwrite in h2oai/h2o-3 - Severity: High 8.2 - Published: Mar 20, 2025 - Affected: from 3.10.4.1, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10550](https://cve.now/CVE-2024-10550): Denial of Service by ReDOS in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.30.0.7, through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-6854](https://cve.now/CVE-2024-6854): Arbitrary File Overwrite in h2oai/h2o-3 - Severity: High 7.1 - Published: Mar 20, 2025 - Affected: from 3.32.1.1, through 3.46.0. - Fixed in 3.46.0.1 (released Mar 14, 2024, 371 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10572](https://cve.now/CVE-2024-10572): Denial of Service and Arbitrary File Write in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.34.0.1, through 3.46.0.1. - Fixed in 3.46.0.2 (released May 13, 2024, 311 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-10553](https://cve.now/CVE-2024-10553): Jdbc Deserialization in h2oai/h2o-3 - Severity: Critical 9.8 - Published: Mar 20, 2025 - Affected: fixed in 3.46.0.6. - Fixed in 3.46.0.6 (released Nov 2, 2024, 138 days before disclosure). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-7765](https://cve.now/CVE-2024-7765): Denial of Service in h2oai/h2o-3 - Severity: High 7.5 - Published: Mar 20, 2025 - Affected: from 3.32.1.2, through 3.46.0.2. - Fixed in 3.46.0.3 (released Jun 11, 2024, 282 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-45758](https://cve.now/CVE-2024-45758): H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to deserialization attacks, file reads, and command… - Severity: Critical 9.1 - Published: Sep 6, 2024 - Affected: through 3.46.0.7. - Fixed in 3.46.0.8 (released Oct 8, 2025, 397 days after disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-5979](https://cve.now/CVE-2024-5979): Denial of Service via Invalid Argument in h2oai/h2o-3 - Severity: High 7.5 - Published: Jun 27, 2024 - Affected: through 3.46.0. - Fixed in 3.46.0.1 (released Mar 14, 2024, 105 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2024-5550](https://cve.now/CVE-2024-5550): Exposure of Sensitive Information via Arbitrary System Path Lookup in h2oai/h2o-3 - Severity: Medium 5.3 - Published: Jun 6, 2024 - Affected: through 3.40.0.4. - Fixed in 3.42.0.1 (released Jul 5, 2023, 337 days before disclosure), the first release outside every affected range (no listed fixed version clears them all). - The latest release, 3.46.0.12, is not affected. ### [CVE-2023-6569](https://cve.now/CVE-2023-6569): External Control of File Name or Path in h2oai/h2o-3 - Severity: Critical 9.3 - Published: Dec 14, 2023 - Affected: fixed in 3.46.0.1. - Fixed in 3.46.0.1 (released Mar 14, 2024, 91 days after disclosure). - The latest release, 3.46.0.12, is not affected. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/pypi/h2o Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.