CVE-2025-6544

Katalog CVE

CVSS 9.8 · Critical EPSS 0,92%

Kerentanan Deserialization of Untrusted Data pada h2o. Skor CVSS 3.0 9.8 (Critical) menurut huntr.dev.

Deskripsi (NVD)

A deserialization vulnerability exists in h2oai/h2o-3 versions <= 3.46.0.8, allowing attackers to read arbitrary system files and execute arbitrary code. The vulnerability arises from improper handling of JDBC connection parameters, which can be exploited by bypassing regular expression checks and using double URL encoding. This issue impacts all users of the affected versions.

Rincian

Terbit di NVD

21 September 2025

Terakhir diubah

1 Oktober 2026

Status NVD

Analyzed

CVSS 3.0

9.8 (Critical), sumber huntr.dev
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-502: Deserialization of Untrusted Data

EPSS (30 hari)

0,92% peluang dieksploitasi; lebih tinggi dari 59,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/h2oai/h2o-3/commit/0298ee348f5c73673b7b542158081e79605f5f25 patch
• https://huntr.com/bounties/53f35a0f-d644-4f82-93aa-89fe7e0aed40 exploit · advisory pihak ketiga