---
id: "CVE-2024-9070"
kind: "vulnerability"
aliases: ["CVE-2024-9070", "GHSA-9g44-gwvm-hc44"]
title: "BentoML deserialization vulnerability"
severity: "critical"
cvss: 9.8
epss: 0.00931
exploited: false
status: "open"
category: "package"
products: [{"name": "bentoml", "fixed": [], "affected": "<= 1.4.5", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["bentoml", "cwe-502", "model-serving", "package", "python", "self-hosted"]
not_affected_if: ["version-above-1.4.5"]
published_at: "2025-03-20T10:15:46+00:00"
first_seen_at: "2026-10-27T15:18:30+00:00"
updated_at: "2026-10-27T15:32:59+00:00"
sources: [{"source": "ghsa", "url": "https://github.com/advisories/GHSA-9g44-gwvm-hc44", "first_seen_at": "2026-10-27T15:18:30+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9070", "first_seen_at": "2026-10-27T15:32:59+00:00"}]
---

# BentoML deserialization vulnerability

BentoML's runner server deserializes request data when the args-number parameter is greater than 1, so an attacker who sends crafted parameters can execute arbitrary code on the server. The advisory gives a CVSS score of 9.8 and lists the affected range as up to 1.4.5, while the description names versions up to 1.3.4.post1.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- pypi:bentoml affected <= 1.4.5 fixed ?

## How to check

- Run `pip show bentoml` and compare the installed version with `1.4.5` and earlier releases
- Check whether the runner server is reachable from untrusted networks, since the sources do not say which ports or paths are exposed by default
- unknown whether the sources list a fixed version

## Fix

- Upgrade `bentoml` to a release newer than `1.4.5`; the fixed version is unknown from the sources, so confirm it in the GHSA advisory
- Restrict network access to the BentoML runner server until upgraded

## Timeline

- 2026-10-27T15:18:30+00:00 ghsa https://github.com/advisories/GHSA-9g44-gwvm-hc44
- 2026-10-27T15:32:59+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-9070

## From the sources

A deserialization vulnerability exists in BentoML's runner server in bentoml/bentoml versions <=1.3.4.post1. By setting specific parameters, an attacker can execute unauthorized arbitrary code on the server, causing severe harm. The vulnerability is triggered when the args-number parameter is greater than 1, leading to automatic deserialization and arbitrary code execution.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_