A critical deserialization vulnerability (CVE-2025-6544) affects h2oai/h2o-3 versions up to 3.46.0.7. It allows attackers to read arbitrary system files and execute arbitrary code by exploiting improper handling of JDBC connection parameters. The vulnerability can be triggered by bypassing regular expression checks and using double URL encoding.