CVE-2024-10553 is a critical deserialization vulnerability in h2oai/h2o-3 REST API versions prior to 3.46.0.6. It allows unauthenticated remote attackers to execute arbitrary code via endpoints that deserialize untrusted data when user-controlled JDBC URLs are processed. The flaw is fixed in version 3.46.0.6.