{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"3.46.0.7"}],"component":"h2o","cve_ids":["CVE-2024-45758"],"ecosystem":"PyPI","epss":0.00906,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-hrmc-jmp7-mpm2","id":"tcs_01M5KFMCEVE09E3CWQM25VAQ0E","modified_at":"2026-10-27T17:45:04.102481180Z","published_at":"2024-09-06T18:31:31Z","references":["https://osv.dev/vulnerability/GHSA-hrmc-jmp7-mpm2","https://nvd.nist.gov/vuln/detail/CVE-2024-45758","https://github.com/h2oai/h2o-3/issues/16425","https://github.com/h2oai/h2o-3/issues/16622","https://github.com/h2oai/h2o-3/pull/16624","https://github.com/h2oai/h2o-3/commit/f714edd6b8429c7a7211b779b6ec108a95b7382d","https://gist.github.com/AfterSnows/c24ca3c26dc89ab797e610e92a6a9acb","https://github.com/h2oai/h2o-3","https://spear-shield.notion.site/Unauthenticated-Remote-Code-Execution-via-Unrestricted-JDBC-Connection-87a958a4874044199cbb86422d1f6068","https://github.com/pypa/advisory-database/tree/main/vulns/h2o/PYSEC-2026-352.yaml","https://pypi.org/project/h2o"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-hrmc-jmp7-mpm2","url":"https://osv.dev/vulnerability/GHSA-hrmc-jmp7-mpm2"}],"summary":"H2O.ai H2O vulnerable to deserialization attacks via a JDBC Connection URL"}