h2o vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Browse by ecosystem

npm PyPI Maven Go RubyGems Cargo NuGet Composer pub Swift GitHub Actions

CVE-IDSeverityPackage summary

CVE-2024-5986Criticalai.h2o:h2o-core: H2O has an External Control of File Name or Path vulnerability CVE-2025-6544Criticalai.h2o:h2o-core: H2O affected by a deserialization vulnerability CVE-2024-8616Highh2o: H2O Vulnerable to Arbitrary File Overwrite CVE-2024-8062Highh2o: H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request CVE-2024-7765Highh2o: H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing CVE-2024-7768Highh2o: H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint CVE-2024-6854Highh2o: H2O Vulnerable to Arbitrary File Overwrite via File Export CVE-2024-6863Mediumh2o: H2O Vulnerable to Execution of Arbitrary Files CVE-2024-10550Highh2o: H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint CVE-2024-10553Criticalh2o: H2O Deserialization of Untrusted Data Vulnerability CVE-2024-10572Highh2o: H2O Vulnerable to Denial of Service (DoS) and File Write CVE-2024-10549Highh2o: H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint CVE-2024-45758Criticalai.h2o:h2o-core: H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL CVE-2024-5979Highh2o: h2o vulnerable to unexpected POST request shutting down server CVE-2024-5550Mediumh2o: Arbitrary system path lookup in h20 CVE-2023-6569Criticalh2o: External Control of File Name or Path in h2oai/h2o-3

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo

Get a personalized demo