CVE-2022-23221: Debian Linux

Critical severity, CVSS 9.8. EPSS: 64.8% chance of exploitation in the next 30 days.

H2 Console before 2.1.210 allows remote attackers to execute arbitrary code via a jdbc:h2:mem JDBC URL containing the IGNORE_UNKNOWN_SETTINGS=TRUE;FORBID_CREATION=FALSE;INIT=RUNSCRIPT substring, a different vulnerability than CVE-2021-42392.

Affected products

• Debian Debian Linux: version 9.0 only; version 10.0 only; version 11.0 only
• h2database h2: from 1.1.100, before 2.0.206 (fixed in 2.0.206)
• Oracle Communications Cloud Native Core Console: version 1.9.0 only

Published 2022-01-19. Last modified 2026-06-17.