CVE-2024-9070

NONE EPSS 53.4%
Published Mar 20, 20251y ago · Modified Jun 17, 20262w ago
Find Similar
Published Mar 20, 2025 1y ago
Last Modified Jun 17, 2026 2w ago

Description

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.

Threat Intelligence

EPSS Exploit Probability
53.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 1

CWE-502 Deserialization of Untrusted Data Validation

References 1

  • huntr.com https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.