CVE-2025-10769 is a medium severity (CVSS 6.3) insecure deserialization flaw in h2oai h2o-3 up to 3.46.08, through the H2 JDBC driver component at /99/ImportSQLTable. The record lists no fixed version. Upgrade only to a release the vendor confirms, and restrict who can reach this endpoint.
What's affected
Affected: h2o-3 up to 3.46.08, per the record. The weakness is in /99/ImportSQLTable, where the connection_url argument is handled by the H2 JDBC driver component. The record says it can be reached remotely and that an exploit has been published.
The CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L. It needs network access and a low privilege account but no user interaction, and it rates low impact across confidentiality, integrity and availability. Real impact of deserialization can be higher than the score suggests, depending on what libraries are on the class path.
The record also says the vendor was contacted early about this disclosure but did not respond in any way. That matters for planning: you should not wait for an upstream patch.
Fixed versions: none confirmed in the record. Check the project's release notes and issue tracker before you trust a version number. The weakness classes are CWE-502 (deserialization of untrusted data) and CWE-20 (improper input validation).
How to check if you're exposed
You can check this with the package manager or the running service.
- Find the version. For a Java service, look at the jar name or the build file, for example
find / -name "*h2o*.jar" 2>/dev/nulland read the version from the file name or manifest. - Compare it with the affected range above (h2o-3 up to 3.46.08).
- Check whether the named endpoint,
/99/ImportSQLTable, is reachable from outside the trusted network. A reverse proxy log search for that path shows who has been calling it. - List who holds an account that can use the data source or import feature, since the record says a low privilege account is enough.
- Look at outbound traffic from the host for connections to unexpected hosts, which can show unwanted driver or lookup activity.
Safeguard has a free in-browser dependency scan at gold.safeguard.sh/scan and a Gold directory where you can look up the CVE record alongside related weaknesses.
What to do now
- Confirm your version against the affected range and note which environments run it.
- Block external access to
/99/ImportSQLTableat the reverse proxy or firewall unless a real user needs it. - Reduce who can create or test data source connections. Treat that ability as a privileged one.
- Check the project's release notes or issue tracker for a fixed build, and upgrade only to one the vendor names. The record states that the vendor did not respond to the disclosure.
- Restrict outbound network access from the host so that it cannot reach arbitrary servers.
- Where you can, limit which JDBC drivers and connection options the application accepts, and review existing data source entries for ones nobody recognises.
- Add this CVE to your tracker so the answer is reviewed again when the vendor responds.
Why it matters
Deserialization flaws happen when an application rebuilds objects from data an outsider controls. If the data names something unexpected, the application may run behaviour that its authors never intended. Here the input is a connection string that a database driver processes, which shows how data source settings can become an attack surface.
The record does not mark this CVE as known exploited (the KEV flag is false), but it does say a public exploit exists. A medium score can understate things when a feature is reachable by users who should not have it, so reachability of the endpoint is the question to answer first.
Quick check
Is there a fixed version for CVE-2025-10769?
The record lists none. Check the vendor project directly and confirm any fix in release notes.
Does the medium score mean I can delay?
No. The score assumes a low privilege account and low impact, but the record says a public exploit exists. Restrict the endpoint first, then plan the upgrade.
Sources
Last reviewed: 19 October 2026.
