CVE-2025-6507 (CVSS 9.8): Critical H2O-3 Vulnerability Puts Machine Learning at Risk

CVE-2025-6507 (CVSS 9.8) is a critical H2O-3 vulnerability that could allow remote code execution and unauthorized file access, affecting version 3.47.0.99999 and prompting a patch in 3.46.0.8, according to CVE. The flaw arises from unsafe deserialization of untrusted data in the JDBC connection handling logic, with researchers showing that attackers can bypass parameter filters by inserting spaces between parameters.

The vulnerability enables two exploit scenarios: arbitrary file read through a crafted JDBC URL and arbitrary deserialization with potential remote code execution by enabling autoDeserialize and chaining gadgets such as Commons-Collections. The researchers demonstrated these exploits using specific POST requests to import SQL tables, including a DNSlog verification chain to confirm exploitability.

H2O[.]ai has released version 3.46.0.8 to patch the issue, and users running affected builds are advised to upgrade immediately, given the risk to enterprise ML workflows where H2O-3 is integrated with Hadoop and Spark. The article notes the potential for attackers to read sensitive files and execute OS commands with application-level privileges.