h2o (PyPI)
Advisories
25
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 3.46.0.10 or later clears every advisory below that has a fix.
Upgrade commands
pip
pip install --upgrade "h2o>=3.46.0.10"poetry
poetry add "h2o>=3.46.0.10"uv
uv add "h2o>=3.46.0.10"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-qmcv-hh7c-3m56 H2O-3 is Vulnerable to Code Injection |
Critical EPSS 0.94% |
< 3.46.0.10 | 3.46.0.10 |
| GHSA-wj3h-wx8g-x699 H2O has an External Control of File Name or Path vulnerability |
Critical EPSS 0.70% |
<= 3.46.0.1 | No fix yet |
| GHSA-wj3h-wx8g-x699 H2O has an External Control of File Name or Path vulnerability |
Critical EPSS 0.70% |
<= 3.46.0.1 | No fix yet |
| GHSA-5w3j-gwgh-4rfv H2O affected by a deserialization vulnerability |
Critical EPSS 0.92% |
<= 3.46.0.7 | No fix yet |
| GHSA-5w3j-gwgh-4rfv H2O affected by a deserialization vulnerability |
Critical EPSS 0.92% |
<= 3.46.0.7 | No fix yet |
| GHSA-g48v-3p35-88jr H2O Vulnerable to Arbitrary File Overwrite |
High EPSS 0.56% |
>= 3.10.4.1, <= 3.46.0 | No fix yet |
| GHSA-g48v-3p35-88jr H2O Vulnerable to Arbitrary File Overwrite |
High EPSS 0.56% |
>= 3.10.4.1, <= 3.46.0 | No fix yet |
| GHSA-5c8j-g96x-cj78 H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request |
High EPSS 0.48% |
>= 3.2.0.1, <= 3.46.0 | No fix yet |
| GHSA-5c8j-g96x-cj78 H2O Vulnerable to Denial of Service (DoS) via `HEAD` Request |
High EPSS 0.48% |
>= 3.2.0.1, <= 3.46.0 | No fix yet |
| GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint |
High EPSS 0.79% |
<= 3.46.1 | No fix yet |
| GHSA-p2vc-m5fv-9w9m H2O Vulnerable to Denial of Service (DoS) via `/3/ImportFiles` Endpoint |
High EPSS 0.79% |
<= 3.46.1 | No fix yet |
| GHSA-6w62-3jvj-mfj6 H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing |
High EPSS 0.78% |
>= 3.32.1.2, <= 3.46.0.2 | No fix yet |
| GHSA-6w62-3jvj-mfj6 H2O Vulnerable to Denial of Service (DoS) via Large GZIP Parsing |
High EPSS 0.78% |
>= 3.32.1.2, <= 3.46.0.2 | No fix yet |
| GHSA-m37h-8r48-2cxj H2O Vulnerable to Execution of Arbitrary Files |
Medium EPSS 0.36% |
>= 3.32.1.2, <= 3.46.0 | No fix yet |
| GHSA-m37h-8r48-2cxj H2O Vulnerable to Execution of Arbitrary Files |
Medium EPSS 0.36% |
>= 3.32.1.2, <= 3.46.0 | No fix yet |
| GHSA-47f6-5p7h-5f3h H2O Vulnerable to Arbitrary File Overwrite via File Export |
High EPSS 0.78% |
>= 3.32.1.1, <= 3.46.0 | No fix yet |
| GHSA-47f6-5p7h-5f3h H2O Vulnerable to Arbitrary File Overwrite via File Export |
High EPSS 0.78% |
>= 3.32.1.1, <= 3.46.0 | No fix yet |
| GHSA-h7xg-cmpp-48hf H2O Deserialization of Untrusted Data Vulnerability |
Critical EPSS 1.59% |
< 3.46.0.6 | 3.46.0.6 |
| GHSA-h7xg-cmpp-48hf H2O Deserialization of Untrusted Data Vulnerability |
Critical EPSS 1.59% |
< 3.46.0.6 | 3.46.0.6 |
| GHSA-7qq7-pvm9-x8rf H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint |
High EPSS 0.64% |
>= 3.30.0.7, <= 3.46.0.1 | No fix yet |
| GHSA-7qq7-pvm9-x8rf H2O Vulnerable to Denial of Service (DoS) via `/3/ParseSetup` Endpoint |
High EPSS 0.64% |
>= 3.30.0.7, <= 3.46.0.1 | No fix yet |
| GHSA-wwr9-4gmr-xvq9 H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint |
High EPSS 0.64% |
>= 3.30.0.7, <= 3.46.0.1 | No fix yet |
| GHSA-wwr9-4gmr-xvq9 H2O Vulnerable to Denial of Service (DoS) via `/3/Parse` Endpoint |
High EPSS 0.64% |
>= 3.30.0.7, <= 3.46.0.1 | No fix yet |
| GHSA-hrmc-jmp7-mpm2 H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL |
Critical EPSS 0.91% |
<= 3.46.0.7 | No fix yet |
| GHSA-hrmc-jmp7-mpm2 H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL |
Critical EPSS 0.91% |
<= 3.46.0.7 | No fix yet |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor