CVE-2025-32375

Published Apr 9, 2025

Last updated 2 months ago

Overview

Description
BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in BentoML's runner server. By setting specific headers and parameters in the POST request, it is possible to execute any unauthorized arbitrary code on the server, which will grant the attackers to have the initial access and information disclosure on the server. This vulnerability is fixed in 1.4.8.
Source
security-advisories@github.com
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
9.8
Impact score
5.9
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity
CRITICAL

Weaknesses

security-advisories@github.com
CWE-502

Social media

Hype score
Not currently trending
  1. GitHub - theGEBIRGE/CVE-2025-32375: This repository includes everything needed to run a PoC exploit for CVE-2025-32375 in a Docker environment. It runs the latest vulnerable version of BentoML (1.4.7). - https://t.co/NLr8MELXZi

    @piedpiper1616

    4 May 2025

    1411 Impressions

    6 Retweets

    37 Likes

    11 Bookmarks

    0 Replies

    0 Quotes

  2. ⚠️ Vulnerability Alert: BentoML Runner Server Insecure Deserialization RCE 📅 Timeline: Disclosure: 2025-04-09, Patch: 2025-04-25 🆔CVE: CVE-2025-32375 📊Base Score: 9.8 📏CVSS Metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvssSeverity: Critical

    @syedaquib77

    26 Apr 2025

    40 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Critical RCE Threat in BentoML! BentoML versions 1.0.0a1-1.4.7 have an RCE vulnerability (CVE-2025-32375) via insecure deserialization. Upgrade to 1.4.8 now! For more details, read ZeroPath's blog on this vuln. https://t.co/bs22pb17ju

    @ZeroPathLabs

    15 Apr 2025

    16 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  4. Critical RCE in BentoML Runner Server: Deep Dive into CVE-2025-32375 Critical RCE Alert: BentoML's Runner Server (CVE-2025-32375) risks remote code execution. Patch to version 1.4.8 now! For more details, read ZeroPath's blog on this vuln. https://t.co/bs22pb17ju

    @ZeroPathLabs

    15 Apr 2025

    34 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  5. CVE-2025-32375 (CVSS:9.8, CRITICAL) is Awaiting Analysis. BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4...https://t.co/azWt7S3Ln8 #cybersecurityawareness #cybersecurity #CVE #infosec #hacker #nvd #mitre

    @cracbot

    14 Apr 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Critical RCE in BentoML Runner Server: Deep Dive into CVE-2025-32375 https://t.co/bs22pb17ju

    @ZeroPathLabs

    13 Apr 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-32375 BentoML is a Python library for building online serving systems optimized for AI apps and model inference. Prior to 1.4.8, there was an insecure deserialization in Be… https://t.co/3lE2w2Ph1i

    @CVEnew

    9 Apr 2025

    294 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. [CVE-2025-32375: CRITICAL] Insecure deserialization vulnerability in BentoML's runner server prior to 1.4.8 allowed unauthorized code execution. Update to version 1.4.8 to patch this critical issue.#cybersecurity,#vulnerability https://t.co/2XCkBX89hJ https://t.co/qc0iCYbxJZ

    @CveFindCom

    9 Apr 2025

    32 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

Configurations