CVE-2025-6544: 
Java vulnerability analysis and mitigation

A deserialization vulnerability (CVE-2025-6544) was discovered in h2oai/h2o-3 versions <= 3.46.0.8. The vulnerability was disclosed on September 21, 2025, and affects the JDBC connection parameter handling functionality. This security flaw allows attackers to read arbitrary system files and execute arbitrary code by exploiting improper handling of JDBC connection parameters through bypassing regular expression checks and using double URL encoding (NVD).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data) with a CVSS v3.0 base score of 9.8 (CRITICAL), indicating maximum impact across confidentiality, integrity, and availability (Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). The technical root cause involves improper validation of JDBC connection parameters, which can be bypassed using double URL encoding techniques (NVD, GitHub Commit).

The vulnerability allows attackers to read arbitrary system files and execute arbitrary code on affected systems. This critical security flaw impacts all users running the affected versions of h2oai/h2o-3, potentially leading to complete system compromise (NVD).

Users should upgrade their h2oai/h2o-3 installations to versions newer than 3.46.0.8. A fix has been implemented in the project's repository that improves the handling of URL-encoded characters in JDBC connection parameters (GitHub Commit).