Unsafe Deserialization in H2O-3 JAR Model Handler

A security flaw has been discovered in h2oai h2o-3 up to 7402. This affects the function importBinaryModel of the file h2o-core/src/main/java/hex/Model.java of the component JAR Handler. Performing a manipulation results in deserialization. The attack is possible to be carried out remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.

Casky was already ahead

This CVE exploits attack patterns that Casky's 419matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

CVE-2026-8751 represents a critical remote code execution vulnerability in H2O-3's model import functionality, specifically within the JAR file handler's deserialization process. When the importBinaryModel function processes untrusted serialized Java objects, an attacker can craft malicious JAR files containing gadget chains that execute arbitrary code during deserialization. This vulnerability affects all H2O-3 deployments up to version 7402, impacting data scientists and machine learning practitioners who rely on H2O for model training and serving. The public availability of exploit code and lack of vendor response significantly elevate the risk profile for organizations using this component.

Casky.ai's 419 mapped security skills detect the attack patterns underlying this vulnerability by correlating evidence across MITRE ATT&CK's Initial Access (TA0001), Defense Evasion (TA0043), and Execution (TA0002) techniques. Practitioners using Casky would identify suspicious patterns including: (1) unexpected JAR file uploads or model imports with anomalous serialization headers, flagging potential Initial Access attempts; (2) process execution spawned from Java deserialization contexts, indicating Execution phase activity; and (3) attempts to disable security managers or bypass input validation controls during model loading, revealing Defense Evasion tactics. Claude's extended reasoning capability correlates CWE-20 (improper input validation) with CWE-502 (deserialization of untrusted data) to distinguish legitimate model operations from exploitation attempts, providing practitioners with high-fidelity detections that reduce false positives while capturing the nuanced attack progression.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

419 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-8751.

analyzing-android-malware-with-apktool

malware analysis · medium

Run

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-bootkit-and-rootkit-samples

malware analysis · medium

Run

MITRE ATT&CK Techniques

TA0001 TA0043 TA0002

Investigate the attack patterns behind CVE-2026-8751

Casky has 419 skills that investigate the attack patterns behind CVE-2026-8751. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn