{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.4.5"}],"component":"bentoml","cve_ids":["CVE-2024-9070"],"ecosystem":"PyPI","epss":0.00931,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9g44-gwvm-hc44","id":"tcs_01M5KFAS60ZBWZVZVE4KA1BNPP","modified_at":"2026-06-29T12:26:14.332189617Z","published_at":"2025-03-20T12:32:50Z","references":["https://osv.dev/vulnerability/GHSA-9g44-gwvm-hc44","https://nvd.nist.gov/vuln/detail/CVE-2024-9070","https://github.com/bentoml/BentoML","https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/server/runner_app.py#L297","https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/server/runner_app.py#L301","https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-9g44-gwvm-hc44","url":"https://osv.dev/vulnerability/GHSA-9g44-gwvm-hc44"}],"summary":"BentoML deserialization vulnerability"}