Please find some backports of CVE fixes for H2Database 1.4.x here:
Initially done to keep a fork of WF26.x fixed, it seems some other libraries have transitive dependencies to these old versions.
At all: It's better to migrate to the latest original version, which we will do as soon as possible.
Happy Christmas
Boris