Executive brief
BentoML deserialization vulnerability
Affected products
- PyPI bentoml
Junglewise Threat Intelligence
CVE-2024-9070: PYSEC-2026-295 - BentoML deserialization vulnerability
CVE-2024-9070 · Severity: low · CVSS 3 · Published 2026-06-29
Technologies: bentoml (PyPI). Vendors: PyPI.
Related threats
- PYSEC-2026-2398 - BentoML Vulnerable to Arbitrary File Write via Symlink Path Traversal in Tar Extraction
- bentoml OpenLLM command injection in Model Repository Directory Name Handler
- PYSEC-2026-1218 - BentoML has a Path Traversal via Bentofile Configuration
- PYSEC-2026-1219 - BentoML Denial of Service (DoS) via Multipart Boundary
- PYSEC-2026-296 - Insecure deserialization in BentoML