ai.h2o:h2o-core (Maven)
Advisories
15
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.46.0.10 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>ai.h2o</groupId><artifactId>h2o-core</artifactId><version>3.46.0.10</version></dependency>gradle
implementation("ai.h2o:h2o-core:3.46.0.10")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qmcv-hh7c-3m56 H2O-3 is Vulnerable to Code Injection |
Critical EPSS 0.94% |
< 3.46.0.10 | 3.46.0.10 |
| GHSA-wj3h-wx8g-x699 H2O has an External Control of File Name or Path vulnerability |
Critical EPSS 0.70% |
<= 3.46.0.1 | No fix yet |
| GHSA-5w3j-gwgh-4rfv H2O affected by a deserialization vulnerability |
Critical EPSS 0.92% |
<= 3.46.0.7 | No fix yet |
| GHSA-g48v-3p35-88jr H2O Vulnerable to Arbitrary File Overwrite |
High EPSS 0.56% |
>= 3.10.4.1, <= 3.46.0 | No fix yet |
| GHSA-5c8j-g96x-cj78 H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request |
High EPSS 0.48% |
>= 3.2.0.1, <= 3.46.0 | No fix yet |
| GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint |
High EPSS 0.79% |
<= 3.46.1 | No fix yet |
| GHSA-6w62-3jvj-mfj6 H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing |
High EPSS 0.78% |
>= 3.32.1.2, <= 3.46.0.2 | No fix yet |
| GHSA-m37h-8r48-2cxj H2O Vulnerable to Execution of Arbitrary Files |
Medium EPSS 0.36% |
>= 3.32.1.2, <= 3.46.0 | No fix yet |
| GHSA-47f6-5p7h-5f3h H2O Vulnerable to Arbitrary File Overwrite via File Export |
High EPSS 0.78% |
>= 3.32.1.1, <= 3.46.0 | No fix yet |
| GHSA-h7xg-cmpp-48hf H2O Deserialization of Untrusted Data Vulnerability |
Critical EPSS 1.59% |
< 3.46.0.6 | 3.46.0.6 |
| GHSA-7qq7-pvm9-x8rf H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint |
High EPSS 0.64% |
>= 3.30.0.7, <= 3.46.0.1 | No fix yet |
| GHSA-wwr9-4gmr-xvq9 H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint |
High EPSS 0.64% |
>= 3.30.0.7, <= 3.46.0.1 | No fix yet |
| GHSA-hrmc-jmp7-mpm2 H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL |
Critical EPSS 0.91% |
<= 3.46.0.7 | No fix yet |
| GHSA-w36w-948j-xhfw H2O vulnerable to Deserialization of Untrusted Data |
High EPSS 0.68% |
<= 3.46.0.4 | No fix yet |
| GHSA-6mv8-95x5-xcq9 H2O local file inclusion vulnerability |
High EPSS 4.34% |
<= 3.40.0.4 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor