Modular Max Serve has Unsafe Deserialization vulnerability

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

PT-2026-53509

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

Insecure Deserialization

Modular is vulnerable to Insecure Deserialization. The vulnerability is due to insecure deserialization when the --experimental-enable-kvcache-agent feature is enabled, allowing attackers to supply crafted serialized data that can be processed by the server and lead to arbitrary code execution...

EUVD-2025-198078

Modular Max Serve has Unsafe Deserialization vulnerability...

Modular Max Serve has Unsafe Deserialization vulnerability

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

Deserialization of Untrusted Data

Overview modular is an A suite of AI libraries and tools that accelerates model serving and provides programmability all the way to the GPU kernels Affected versions of this package are vulnerable to Deserialization of Untrusted Data via the kvcacheagent process when the...

PYSEC-2025-253

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

PYSEC-2025-253

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

CVE-2025-60455

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

CVE-2025-60455: Deserialization of Untrusted Data

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

CVE-2025-60455

The Modular Max Serve software (specifically the modular AI library) is vulnerable to an Unsafe Deserialization vulnerability (CWE-502) in versions prior to 25.6 . The issue exists when the "--experimental-enable-kvcache-agent" feature is explicitly enabled, allowing an attacker to supply crafted...

CVE-2025-60455

Unsafe Deserialization vulnerability in Modular Max Serve before 25.6, specifically when the "--experimental-enable-kvcache-agent" feature is used allowing attackers to execute arbitrary code...

PT-2025-47378

Name of the Vulnerable Software and Affected Versions Modular Max Serve versions prior to 25.6 Description An unsafe deserialization issue exists in Modular Max Serve when the "--experimental-enable-kvcache-agent" feature is utilized. This allows attackers to potentially execute arbitrary code. T...