{"action":"Upgrade bentoml to 1.2.5 or later.","affected":[{"fixed":"1.2.5","introduced":"0"}],"component":"bentoml","cve_ids":["CVE-2024-2912"],"ecosystem":"PyPI","epss":0.01509,"exploited":false,"fixed_versions":["1.2.5"],"ghsa_id":"GHSA-hvj5-mvw9-93j3","id":"tcs_01M5KFMEVXTJRFA9PHS5113Y5B","modified_at":"2026-06-29T12:26:42.673200957Z","published_at":"2024-04-16T00:30:33Z","references":["https://osv.dev/vulnerability/GHSA-hvj5-mvw9-93j3","https://nvd.nist.gov/vuln/detail/CVE-2024-2912","https://github.com/bentoml/bentoml/commit/fd70379733c57c6368cc022ac1f841b7b426db7b","https://github.com/bentoml/BentoML","https://huntr.com/bounties/349a1cce-6bb5-4345-82a5-bf7041b65a68"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-hvj5-mvw9-93j3","url":"https://osv.dev/vulnerability/GHSA-hvj5-mvw9-93j3"}],"summary":"Insecure deserialization in BentoML"}