{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.10.4.1","last_affected":"3.46.0"}],"component":"h2o","cve_ids":["CVE-2024-8616"],"ecosystem":"PyPI","epss":0.00557,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-g48v-3p35-88jr","id":"tcs_01M5KGSMJA90HZAKPWJ1DVSDTK","modified_at":"2026-07-07T17:46:12.517317926Z","published_at":"2026-07-07T14:34:57.173944Z","references":["https://osv.dev/vulnerability/PYSEC-2026-1441","https://nvd.nist.gov/vuln/detail/CVE-2024-8616","https://github.com/h2oai/h2o-3","https://github.com/h2oai/h2o-3/blob/088190f9d0370a02a483fca68d8dc89c996b4f83/h2o-core/src/main/java/water/api/ModelsHandler.java#L310","https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11a8c97a","https://pypi.org/project/h2o","https://github.com/advisories/GHSA-g48v-3p35-88jr"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"PYSEC-2026-1441","url":"https://osv.dev/vulnerability/PYSEC-2026-1441"}],"summary":"H2O Vulnerable to Arbitrary File Overwrite"}