H2O ImportFiles - Local File Inclusion

An attacker is able to read any file on the server hosting the H2O dashboard without any authentication. id: CVE-2023-6038 info: name: H2O ImportFiles - Local File Inclusion author: danmcinerney,byt3bl33d3r severity: high description: | An attacker is able to read any file on the server hosting t...

CVE-2025-4275

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing This repository contains research material related to CVE-2025-4275, a Secure Boot bypass vulnerability affecting UEFI-compatible firmware based on Insyde H2O. It centralizes technical analysis of the vulnerability, the binaries...

CVE-2025-4275 — Updated!

🐞 CVE-2025-4275: Hydroph0bia SecureFlash Certificate Shadowing This repository contains research material related to CVE-2025-4275, a Secure Boot bypass vulnerability affecting UEFI-compatible firmware based on Insyde H2O. It centralizes technical analysis of the vulnerability, the binaries...

ae.teletronics.nlp:entityextraction (>=1.3, <=1.4), ai.h2o:h2o-app (>=0.1.22, <=0.1.25) +1042 more potentially affected by CVE-2026-58063 via org.bouncycastle:bcprov-jdk15 (>=1.38, <=1.46)

org.bouncycastle:bcprov-jdk15 MAVEN version =1.38, =1.3, =0.1.22, =0.1.22, =1.0.0, =2.1.0, =1.0.1, =4.2.0, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.1.2, =1.0.3, =1.3.3 and more Source cves: CVE-2026-58063 Source advisory:...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-13586 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-13586 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18518992...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-15055 Source advisory: SNYK:JAVA-ORGBOUNCYCASTLE-18517495...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-12802 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-12802 Source advisory: MEND:CVE-2026-12802...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-59639 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-59639 Source advisory: MEND:CVE-2026-59639...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-59642 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-59642 Source advisory: MEND:CVE-2026-59642...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-59647 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-59647 Source advisory: MEND:CVE-2026-59647...

ai.covia:covia-core (>=0.4.0, <=0.6.0), ai.covia:covia-sql (0.6.0) +10857 more potentially affected by CVE-2026-15055 via org.bouncycastle:bcpkix-jdk18on (>=1.71, <=1.84)

org.bouncycastle:bcpkix-jdk18on MAVEN version =1.71, =0.4.0, =0.4.0, =0.4.0, =0.6.0, =0.5.0, =0.7.0, =0.7.0, =0.5.0, =0.8.3, =0.8.3, =0.8.3, =0.5.0, =0.5.0, =3.10.0.5, =3.10.3.6 and more Source cves: CVE-2026-15055 Source advisory: MEND:CVE-2026-15055...

ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7847 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.58.v20250814)

org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =3.30.0.7, =3.30.0.7, =3.38.0.1, =3.42.0.4 and more Source cves: CVE-2026-6790 Source advisory: OSV:GHSA-7P3P-8QV8-M2VH...

Linux Distros Unpatched Vulnerability : CVE-2026-44453

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 6b5370d, h2o is vulnerable to a Denial of Service attack when calling alloca...

Linux Distros Unpatched Vulnerability : CVE-2026-54340

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK...

Linux Distros Unpatched Vulnerability : CVE-2026-44452

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 8dc37cb, when h2o receives a ClientHello message over TLS or QUIC and it...

DEBIAN-CVE-2026-54340

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

CVE-2026-54340

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

CVE-2026-54340: Uncontrolled Resource Consumption

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

CVE-2026-54340 h2o has HTTP/2 state amplification

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...

CVE-2026-54340 h2o has HTTP/2 state amplification

h2o is an HTTP server with support for HTTP/1.x, HTTP/2 and HTTP/3. Prior to commit 9265bdd, there is an HTTP/2 state amplification issue that combines HPACK decompression amplification with Slowloris-style stream stalling. Amplified decoded header state can be retained by stalled HTTP/2 streams,...