Most recent entries from all

CVE-2021-42392

2026-10-06T11:30:32.515055+00:00

Affected: h2database h2

The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote code execution. This can be exploited through various attack vectors, most notably through the H2 Console which leads to unauthenticated remote code execution.

USN-5365-1 — h2database vulnerabilities

2026-10-06T11:30:32.515137+00:00

Affected: Ubuntu:20.04:LTS: h2database

It was discovered that H2 was vulnerable to deserialization of untrusted data. An attacker could possibly use this issue to execute arbitrary code. (CVE-2021-42392)

It was discovered that H2 incorrectly handled some specially crafted connection URLs. An attacker could possibly use this issue to execute arbitrary code. (CVE-2022-23221)