TI-2024-05547 Aliases CVE-2024-5986 GHSA-wj3h-wx8g-x699

Remote Arbitrary File Write with Arbitrary Data in h2oai/h2o-3

MEDIUM 48CWE-73Published 2026-02-02 · Updated 2026-02-02

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: None · High · High
Fix status: No fix listed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub.

Summary

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the `/3/Parse` endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the `/3/Frames/framename/export` endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00704 53rd percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
h2oai	h2oai/h2o-3	up to latest	—	No fix listed	CNA
—	ai.h2o:h2o-core (Maven)	up to 3.46.0.1	—	No fix listed	GHSA-wj3h-wx8g-x699
—	h2o (PyPI)	up to 3.46.0.1	—	No fix listed	GHSA-wj3h-wx8g-x699

h2oai/h2o-3 Vendorh2oai Affected up to latest Fixed in — No fix listed CNA
ai.h2o:h2o-core (Maven) Vendor— Affected up to 3.46.0.1 Fixed in — No fix listed GHSA-wj3h-wx8g-x699
h2o (PyPI) Vendor— Affected up to 3.46.0.1 Fixed in — No fix listed GHSA-wj3h-wx8g-x699

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:h2o:h2o::::::::	—	—	h2oai

cpe:2.3:a:h2o:h2o:*:*:*:*:*:*:*:* Versions — — ·h2oai

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2024-5986
2026-10-03 Alias added: GHSA-wj3h-wx8g-x699

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2024-5986

Other 4

TI-2025-05944 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2025-05102 Deserialization Vulnerability in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2024-09776 Jdbc Deserialization in h2oai/h2o-3 CVSS 3.0CRITICAL 9.8
TI-2026-46834 h2oGPT 0.2.1 Path Traversal via OpenAI-compatible Files API CVSS 4.0CRITICAL 9.3
TI-2024-30727 H2O.ai H2O through 3.46.0.4 allows attackers to arbitrarily set the JDBC URL, leading to… CVSS 3.1CRITICAL 9.1
TI-2026-03424 Remote Code Execution in h2oai/h2o-3 CVSS 3.1CRITICAL 9.8

See all 52 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences