{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0","last_affected":"1.4.5"}],"component":"bentoml","cve_ids":["CVE-2024-9070"],"ecosystem":"PyPI","epss":0.00931,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-9g44-gwvm-hc44","id":"tcs_01M5KH2HF9B88J9PHPSWMAZQEG","modified_at":"2026-07-01T20:22:49.834435Z","published_at":"2026-06-29T11:50:34.505033Z","references":["https://osv.dev/vulnerability/PYSEC-2026-295","https://nvd.nist.gov/vuln/detail/CVE-2024-9070","https://github.com/bentoml/BentoML","https://github.com/bentoml/BentoML/blob/a6f5f937be6ec278f3d4f3bbc6f3c8f9564820d7/src/bentoml/_internal/server/runner_app.py#L297","https://github.com/bentoml/BentoML/blob/v1.4.5/src/bentoml/_internal/server/runner_app.py#L301","https://huntr.com/bounties/7be6fc22-be18-44ee-a001-ac7158d5e1a5","https://pypi.org/project/bentoml","https://github.com/advisories/GHSA-9g44-gwvm-hc44"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"PYSEC-2026-295","url":"https://osv.dev/vulnerability/PYSEC-2026-295"}],"summary":"BentoML deserialization vulnerability"}