{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"3.10.4.1","last_affected":"3.46.0"}],"component":"ai.h2o:h2o-core","cve_ids":["CVE-2024-8616"],"ecosystem":"Maven","epss":0.00557,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-g48v-3p35-88jr","id":"tcs_01M5N8X88X7VRDZM3DNAWNQPMN","modified_at":"2026-07-07T17:56:21.858937760Z","published_at":"2025-03-20T12:32:48Z","references":["https://osv.dev/vulnerability/GHSA-g48v-3p35-88jr","https://nvd.nist.gov/vuln/detail/CVE-2024-8616","https://github.com/h2oai/h2o-3","https://github.com/h2oai/h2o-3/blob/088190f9d0370a02a483fca68d8dc89c996b4f83/h2o-core/src/main/java/water/api/ModelsHandler.java#L310","https://huntr.com/bounties/aebf69a5-b9b1-4d2f-a8ff-902c11a8c97a"],"severity":{"label":"high","score":8.2},"sources":[{"source":"osv","source_id":"GHSA-g48v-3p35-88jr#Maven/ai.h2o:h2o-core","url":"https://osv.dev/vulnerability/GHSA-g48v-3p35-88jr"}],"summary":"H2O Vulnerable to Arbitrary File Overwrite"}