What is the CVSS score of CVE-2024-5986?

CVE-2024-5986 has a CVSS 3.0 base score of 9.1 (Critical). CVSS vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H. EPSS exploitation probability: 0.1%.

How to fix or mitigate CVE-2024-5986?

Within 24 hours: Identify all systems running h2o-3 and assess network exposure; isolate critical instances if possible. Within 7 days: Implement compensating controls (WAF rules, network segmentation, API authentication enforcement); contact h2o.ai for patch timeline estimates. Within 30 days: Apply vendor patch immediately upon release; conduct forensic analysis for indicators of compromise; validate remediation across all affected systems.

CVE-2024-5986

CRITICAL

External Control of File Name or Path (CWE-73)

2026-02-02 security@huntr.dev

GHSA-wj3h-wx8g-x699

RCE

9.1

CVSS 3.0 · NVD

Severity by source

NVD PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 22:01 vuln.today

CVE Published

Feb 02, 2026 - 11:16 nvd

CRITICAL 9.1

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

30 maven packages depend on ai.h2o:h2o-core (22 direct, 8 indirect)

Ecosystem-wide dependent count for version 3.46.0.1.

DescriptionCVE.org

A vulnerability in h2oai/h2o-3 version 3.46.0.1 allows remote attackers to write arbitrary data to any file on the server. This is achieved by exploiting the /3/Parse endpoint to inject attacker-controlled data as the header of an empty file, which is then exported using the /3/Frames/framename/export endpoint. The impact of this vulnerability includes the potential for remote code execution and complete access to the system running h2o-3, as attackers can overwrite critical files such as private SSH keys or script files.