{"id":"CVE-2024-10553","summary":"Jdbc Deserialization in h2oai/h2o-3","details":"A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are passed to DriverManager.getConnection, leading to deserialization if a MySQL or PostgreSQL driver is available in the classpath. This issue is fixed in version 3.47.0.","aliases":["GHSA-h7xg-cmpp-48hf","PYSEC-2026-351"],"modified":"2026-08-12T15:16:57.061756Z","published":"2025-03-20T10:09:04.913Z","database_specific":{"cna_assigner":"@huntr_ai","cwe_ids":["CWE-502"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10553.json","unresolved_ranges":[{"extracted_events":[{"fixed":"3.47.0"}],"source":"AFFECTED_FIELD"}]},"references":[{"type":"WEB","url":"https://huntr.com/bounties/e6f550dd-eda2-428c-a740-ed8f893a084b"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10553.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10553"},{"type":"FIX","url":"https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/h2oai/h2o-3","events":[{"introduced":"a24dd872beb239f3f8921820fc0c4bd9de3f8dd9"},{"fixed":"ac1d642b4d86f10a02d75974055baf2a4b2025ac"}],"database_specific":{"source":["CPE_STRING","REFERENCES"],"cpe":"cpe:2.3:a:h2o:h2o:3.46.0.4:*:*:*:*:*:*:*","extracted_events":[{"introduced":"3.46.0.4"},{"last_affected":"3.46.0.4"}]}}],"versions":["3.46.0.4","jenkins-rel-3.46.0-5","jenkins-3.46.0.5","jenkins-rel-3.46.0-4","jenkins-3.46.0.4"],"database_specific":{"vanir_signatures":[{"deprecated":false,"digest":{"function_hash":"168816719982287770981110467877407296836","length":331},"id":"CVE-2024-10553-395c6987","signature_type":"Function","signature_version":"v1","source":"https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac","target":{"file":"h2o-core/src/main/java/water/jdbc/SQLManager.java","function":"getConnectionSafe"}},{"target":{"file":"h2o-core/src/main/java/water/jdbc/SQLManager.java","function":"importSqlTable"},"deprecated":false,"digest":{"function_hash":"190704215970352568582881088499490350282","length":607},"id":"CVE-2024-10553-4c363082","signature_type":"Function","signature_version":"v1","source":"https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac"},{"target":{"file":"h2o-core/src/main/java/water/jdbc/SQLManager.java"},"deprecated":false,"digest":{"line_hashes":["300451468381251302729133872593402201545","252908786993601715595876974109271588348","10801937721548681594632862534605650681","9423190181843344384806367822050451322","227488768061697099239980640670601215227","316742949932481921682790972830828141023","221747699757561979942663759029883784899","174988231897645054029137978980406567093","338297435257418145061421683743409573372","108724650822201000318550971372101398772","170590909252239114651385301705348166597","203574655414930643365103733016374486186","203372091579464334002843783006599322199","226823000619405657601650876101252911533","211537658870709066147887120523182385619","337506303001316219262103506009455255380","123477289073643657779683900089844838158","116741747136631521503695341896450644192","182520457555272385502724177175461447459","131570643222693320033148107955518213557","209286989575944391901629413543522918514"],"threshold":0.9},"id":"CVE-2024-10553-72e872a7","signature_type":"Line","signature_version":"v1","source":"https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac"},{"id":"CVE-2024-10553-cd692acb","signature_type":"Line","signature_version":"v1","source":"https://github.com/h2oai/h2o-3/commit/ac1d642b4d86f10a02d75974055baf2a4b2025ac","target":{"file":"h2o-core/src/test/java/water/jdbc/SQLManagerTest.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["59195090619537486638448282897914155446","24561648639743877178903633622248367680"]}}],"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-10553.json","vanir_signatures_modified":"2026-08-12T15:16:57Z"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}