{"action":"Upgrade com.h2database:h2 to 2.0.206 or later.","affected":[{"fixed":"2.0.206","introduced":"1.1.100"}],"component":"com.h2database:h2","cve_ids":["CVE-2021-42392"],"ecosystem":"Maven","epss":0.83176,"exploited":false,"fixed_versions":["2.0.206"],"ghsa_id":"GHSA-h376-j262-vhq6","id":"tcs_01M5N8ZFCDS81AN5S5C0511P4Y","modified_at":"2026-07-08T06:29:10.179422215Z","published_at":"2022-01-06T23:55:09Z","references":["https://osv.dev/vulnerability/GHSA-h376-j262-vhq6","https://github.com/h2database/h2database/security/advisories/GHSA-h376-j262-vhq6","https://nvd.nist.gov/vuln/detail/CVE-2021-42392","https://github.com/h2database/h2database","https://github.com/h2database/h2database/releases/tag/version-2.0.206","https://jfrog.com/blog/the-jndi-strikes-back-unauthenticated-rce-in-h2-database-console","https://lists.debian.org/debian-lts-announce/2022/02/msg00017.html","https://security.netapp.com/advisory/ntap-20220119-0001","https://www.debian.org/security/2022/dsa-5076","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.secpod.com/blog/log4shell-critical-remote-code-execution-vulnerability-in-h2database-console"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-h376-j262-vhq6","url":"https://osv.dev/vulnerability/GHSA-h376-j262-vhq6"}],"summary":"RCE in H2 Console"}