BentoML runner server deserialization vulnerability

Added: 10/24/2025 CVE: CVE-2024-9070 Background BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Problem A deserialization vulnerability in the BentoML runner server allows remote attackers to execute arbitrary commands by sending a...

BentoML runner server deserialization vulnerability

Added: 10/24/2025 CVE: CVE-2024-9070 Background BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Problem A deserialization vulnerability in the BentoML runner server allows remote attackers to execute arbitrary commands by sending a...

CVE-2024-9070

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

CVE-2024-9070

creationtimestamp| type| source ---|---|--- 2025-03-20 11:40:51+00:00| seen| https://bsky.app/profile/cyberalerts.bsky.social/post/3lksmhzifc524 2025-03-20 12:48:35+00:00| seen| https://mastodon.social/users/CyberSignaler/statuses/114194835990694470...

CVE-2024-9070

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

CVE-2024-9070

The CVE-2024-9070 issue concerns BentoML’s runner server (bentoml/bentoml) with versions up to and including 1.3.4.post1. A deserialization vulnerability allowed remote attackers to trigger arbitrary code execution by sending a crafted pickle payload when args-number > 1, leading to automatic ...

CVE-2024-9070 Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...

CVE-2024-9070 Deserialization Vulnerability in BentoML's Runner Server in bentoml/bentoml

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions =1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is...