PyPI/snowflake-connector-python CVE-2025-24794: medium 6.7, EPSS 0.25%

snowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache

Action: Upgrade snowflake-connector-python to 3.13.1 or later.

pip install snowflake-connector-python==3.13.1

Affected

Fixed versions

Sources

• osv: GHSA-m4f6-vcj4-w5mx
• https://github.com/snowflakedb/snowflake-connector-python/security/advisories/GHSA-m4f6-vcj4-w5mx
• https://nvd.nist.gov/vuln/detail/CVE-2025-24794
• https://github.com/snowflakedb/snowflake-connector-python/commit/3769b43822357c3874c40f5e74068458c2dc79af
• https://github.com/pypa/advisory-database/tree/main/vulns/snowflake-connector-python/PYSEC-2025-27.yaml
• https://github.com/snowflakedb/snowflake-connector-python
• https://github.com/snowflakedb/snowflake-connector-python/releases/tag/v3.13.1

CVE-2025-24794 · published 2025-01-29T20:50:18Z · modified 2026-09-10T03:50:22.103099115Z · JSON