Loading...
Skip to main content
GeekWala

CVE-2024-2912 — Insecure deserialization in bentoml — CVE Details

CRITICAL

Insecure deserialization in BentoML

Published June 29, 2026Updated July 1, 2026Source: osv

Summary

An insecure deserialization vulnerability exists in the BentoML framework, allowing remote code execution (RCE) by sending a specially crafted POST request. By exploiting this vulnerability, attackers can execute arbitrary commands on the server hosting the BentoML application. The vulnerability is triggered when a serialized object, crafted to execute OS commands upon deserialization, is sent to any valid BentoML endpoint. This issue poses a significant security risk, enabling attackers to compromise the server and potentially gain unauthorized access or control.

Advisory Timeline

  • First published June 29, 2026 (105 days ago).
  • Last revised July 1, 2026 — 2 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

pip
Update bentoml to 1.2.5 or later
pip install "bentoml>=1.2.5"

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (1)

Affects 1 ecosystem: pypi (1).

PackageEcosystemAffectedFixed In
bentoml
pypi
0.0.1, 0.0.2, 0.0.3, 0.0.5 (+131 more)1.2.5

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-2912?
Insecure deserialization in BentoML This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-2912?
CVE-2024-2912 affects bentoml. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-2912 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

PYSEC-2026-296
GHSA-hvj5-mvw9-93j3

Related CVEs

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies