Deserialization of Untrusted Data

Overview yiisoft/yii2 is a Yii PHP Framework. Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the Generate function. Details Serialization is a process of converting an object into a sequence of bytes which can be persisted to a disk or database or can be...

CVE-2025-29807

Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network...

CVE-2024-10553

A vulnerability in the h2oai/h2o-3 REST API versions 3.46.0.4 allows unauthenticated remote attackers to execute arbitrary code via deserialization of untrusted data. The vulnerability exists in the endpoints POST /99/ImportSQLTable and POST /3/SaveToHiveTable, where user-controlled JDBC URLs are...

CVE-2024-8502

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

AZL-59242 CVE-2025-30204 affecting package packer for versions less than 1.9.5-12

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

UBUNTU-CVE-2025-30204

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

GHSA-MH63-6H87-95CP jwt-go allows excessive memory allocation during header parsing

Summary Function parse.ParseUnverified currently splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs...

jwt-go allows excessive memory allocation during header parsing

Summary Function parse.ParseUnverified currently splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose Authorization header consists of Bearer followed by many period characters, a call to that function incurs...

CVE-2025-30204 jwt-go allows excessive memory allocation during header parsing

golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.ParseUnverified splits via a call to strings.Split its argument which is untrusted data on periods. As a result, in the face of a malicious request whose...

CVE-2025-30204

CVE-2025-30204 affects golang-jwt (jwt-go). In versions prior to 5.2.2 and 4.5.2, parse.ParseUnverified splits the untrusted Authorization header (Bearer …) on periods using strings.Split, causing O(n) memory allocations for long inputs (approx. 16 bytes per unit). This can lead to significantly ...

Deserialization of Untrusted Data

Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the /api/v2/models/install API. An attacker can execute...

CVE-2025-29807

Deserialization of untrusted data in Microsoft Dataverse allows an authorized attacker to execute code over a network...

Deserialization of Untrusted Data

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the makehandlercoro function used by the async RPC server for communication between nodes, which uses pickle fo...

Deserialization of Untrusted Data

Overview bentoml is a BentoML: Build Production-Grade AI Applications Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the args-number parameter. An attacker can execute unauthorized arbitrary code on the server by setting a value greater than 1 to the...

GHSA-9W5H-67GF-XVV8 AgentScope Deserialization Vulnerability

A vulnerability in the RpcAgentServerLauncher class of modelscope/agentscope v0.0.6a3 allows for remote code execution RCE via deserialization of untrusted data using the dill library. The issue occurs in the AgentServerServicer.createagent method, where serialized input is deserialized using...

Deserialization of Untrusted Data

Overview agentscope is an AgentScope: A Flexible yet Robust Multi-Agent Platform. Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the AgentServerServicer.createagent method. An attacker can execute arbitrary commands on the server by deserializing untrust...

Deserialization of Untrusted Data

Overview vllm is an A high-throughput and memory-efficient inference and serving engine for LLMs Affected versions of this package are vulnerable to Deserialization of Untrusted Data in the MessageQueue.dequeue API function. An attacker can execute arbitrary code by sending a malicious payload to...

Deserialization of Untrusted Data

Overview Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the DriverManager.getConnection method. An attacker can execute arbitrary code by passing malicious JDBC URLs that lead to deserialization of untrusted data. Details Serialization is a process of...

Deserialization of Untrusted Data

Overview horovod is a Distributed training framework for TensorFlow, Keras, PyTorch, and Apache MXNet. Affected versions of this package are vulnerable to Deserialization of Untrusted Data due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandle...