Read the docs
TI-2021-18806 Aliases CVE-2021-42392GHSA-h376-j262-vhq6

Deserialization of untrusted data in h2database h2

Priority HIGH 83CWE-502Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Partial Red Hat: 12 fixed, 13 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-502.

Summary

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

Why it matters now

EPSS 0.83176 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial com.h2database:h2 (Maven): 2.0.206Red Hat: 12 advisoriesRed Hat: 12 fixed, 13 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
h2databaseh21.1.000 and later—No fix listedCNA
—com.h2database:h2 (Maven)1.1.100 to before 2.0.2062.0.206Patch availableGHSA-h376-j262-vhq6
  • h2 Vendorh2database Affected 1.1.000 and later Fixed in — No fix listed CNA
  • com.h2database:h2 (Maven) Vendor— Affected 1.1.100 to before 2.0.206 Fixed in 2.0.206 Patch available GHSA-h376-j262-vhq6

CPE configurations NVD · 5

CPEVersionsRoleVendor
cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:*1.1.000 – 2.0.204Vulnerableh2database
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:*1.15.0VulnerableOracle
  • cpe:2.3:a:h2database:h2:*:*:*:*:*:*:*:* Versions 1.1.000 – 2.0.204 Vulnerable ·h2database
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-h376-j262-vhq6 com.h2database:h2 (Maven) Fixed in 2.0.206 Advisory →

Red Hat 12 advisories

  • RHSA-2025:1747 Released 2025-02-24 · Red Hat rating Critical
    Red Hat JBoss Enterprise Application Platform 7.3.12 security update
    • Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 Server eap7-hal-console-3.2.17-1.Final_redhat_00001.1.el7eap, eap7-jackson-annotations-2.10.4-2.redhat_00004.1.el7eap, eap7-jackson-core-2.10.4-2.redhat_00004.1.el7eap +38
  • RHSA-2022:7417 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update
    • Red Hat Single Sign-On 7.6.1
  • RHSA-2022:7411 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-1-5.el9sso, rh-sso7-javapackages-filesystem-6.0.0-7.el9sso, rh-sso7-javapackages-tools-6.0.0-7.el9sso +4
Show 9 more Red Hat advisories
  • RHSA-2022:7410 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el8sso
  • RHSA-2022:7409 Released 2022-11-03 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.6.1 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.3-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.3-1.redhat_00001.1.el7sso
  • RHSA-2022:6782 Released 2022-10-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.3 security update on RHEL 7
    • Red Hat Single Sign-On 7.5 for RHEL 7 Server rh-sso7-keycloak-15.0.8-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-15.0.8-1.redhat_00001.1.el7sso
  • RHSA-2022:6787 Released 2022-10-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.3 security update
    • Red Hat Single Sign-On 7
  • RHSA-2022:6783 Released 2022-10-04 · Red Hat rating Moderate
    Red Hat Single Sign-On 7.5.3 security update on RHEL 8
    • Red Hat Single Sign-On 7.5 for RHEL 8 rh-sso7-keycloak-15.0.8-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-15.0.8-1.redhat_00001.1.el8sso
  • RHSA-2022:4919 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 8
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el8eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el8eap +47
  • RHSA-2022:4918 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update on RHEL 7
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-cli-2.16.0-9.redhat_00042.1.el7eap, eap7-activemq-artemis-commons-2.16.0-9.redhat_00042.1.el7eap +47
  • RHSA-2022:4922 Released 2022-06-06 · Red Hat rating Moderate
    Red Hat JBoss Enterprise Application Platform 7.4.5 security update
    • Red Hat JBoss Enterprise Application Platform com.fasterxml.jackson.core.jackson-databind-2.12.6.1-redhat-00003.jar, com.h2database.h2-1.4.197.redhat-00004.jar, io.netty.netty-codec-4.1.72.Final-redhat-00001.jar +8
  • RHSA-2022:1013 Released 2022-03-22 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus 2.2.1 security update
    • RHINT Camel-Q 2.2.1

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat BPM Suite 6AffectedNo fix planned: Out of support scope
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss BRMS 5AffectedNo fix planned: Out of support scope
Red Hat JBoss BRMS 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Virtualization 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Operations Network 3AffectedNo fix planned: Out of support scope
Red Hat JBoss SOA Platform 5AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat build of Apicurio Registry 2AffectedNo fix yet
RHINT Camel-Q 2.2.1Fixed RHSA-2022:1013
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2022:4918
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2022:4919
Red Hat JBoss Enterprise Application Platform Fixed RHSA-2022:4922
Red Hat JBoss Enterprise Application Platform 7.3 EUS for RHEL 7 ServerFixed RHSA-2025:1747
Red Hat Single Sign-On 7Fixed RHSA-2022:6787
Red Hat Single Sign-On 7.5 for RHEL 7 ServerFixed RHSA-2022:6782
Red Hat Single Sign-On 7.5 for RHEL 8Fixed RHSA-2022:6783
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2022:7409
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2022:7410
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2022:7411
Red Hat Single Sign-On 7.6.1Fixed RHSA-2022:7417
Not affected: 8 products
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss EAP 7.4 for RHEL 7 Server
  • Red Hat JBoss EAP 7.4 for RHEL 8
  • Red Hat JBoss Enterprise Application Platform
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-42392
  2. 2026-10-03 Alias added: GHSA-h376-j262-vhq6

References

Exploit 1

Patch 1

Advisory 5

Other 6

  • TI-2022-07362 H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a… CVSS 3.1CRITICAL 9.8
  • TI-2022-22667 The web-based admin console in H2 Database Engine before 2.2.220 can be started via the… CVSS 3.1HIGH 8.4
  • TI-2018-07125 H2 1.4.197, as used in Datomic before 0.9.5697 and other products, allows remote code… CVSS 3.1HIGH 8.8
  • TI-2018-10278 An issue was discovered in H2 1.4.197. CVSS 3.1MEDIUM 6.5
  • TI-2021-06145 XML external entity (XXE) injection in com.h2database:h2 CVSS 3.1CRITICAL 9.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences