h2database (1.4.197-4+deb11u1) bullseye-security; urgency=high
.
  * Team upload.
  * Security researchers of JFrog Security and Ismail Aydemir discovered two
    remote code execution vulnerabilities in the H2 Java SQL database engine
    which can be exploited through various attack vectors, most notably through
    the H2 Console and by loading custom classes from remote servers through
    JNDI. The H2 console is a developer tool and not required by any
    reverse-dependency in Debian. It has been disabled in (old)stable
    releases. Database developers are advised to use at least version
    2.1.210-1, currently available in Debian unstable.