https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 11:53:42 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-00109 bdu:2026-00109 https://cve.radiocsirt.org/vuln/bdu:2026-00109 https://cve.radiocsirt.org/vuln/euvd-2026-248716 EUVD-2026-248716 https://cve.radiocsirt.org/vuln/euvd-2026-248716 https://cve.radiocsirt.org/vuln/fkie_cve-2025-54381 <p>BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.</p> <p>BentoML is a Python library for building online serving systems optimized for AI apps and model inference. In versions 1.4.0 until 1.4.19, the file upload processing system contains an SSRF vulnerability that allows unauthenticated remote attackers to force the server to make arbitrary HTTP requests. The vulnerability stems from the multipart form data and JSON request handlers, which automatically download files from user-provided URLs without validating whether those URLs point to internal network addresses, cloud metadata endpoints, or other restricted resources. The documentation explicitly promotes this URL-based file upload feature, making it an intended design that exposes all deployed services to SSRF attacks by default. Version 1.4.19 contains a patch for the issue.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-54381 https://cve.radiocsirt.org/vuln/ghsa-mrmq-3q62-6cc8 <p><strong>Affected:</strong> PyPI: bentoml</p> <p>### Description</p> <p>There&#39;s an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses.</p> <p>The framework automatically registers any service endpoint with file-type parameters (`pathlib.Path`, `PIL.Image.Image`) as vulnerable to this attack, making it a framework-wide security issue that affects most real-world ML services handling file uploads. While BentoML implements basic URL scheme validation in the `JSONSerde` path, the `MultipartSerde` path has no validation whatsoever, and neither path restricts access to internal networks, cloud metadata endpoints, or localhost services.</p> <p>The documentation explicitly promotes this URL-based file upload feature, making it an intended but insecure design that exposes all deployed services to SSRF attacks by default.</p> <p>### Source - Sink Analysis</p> <p>**Source:** User-controlled multipart form field values and JSON request bodies containing URLs</p> <p>**Call Chain - Path 1 (MultipartSerde - No Validation):** 1. HTTP POST request with multipart form data to any BentoML endpoint with file-type input parameters 2. `MultipartSerde.parse_request()` in `src/_bentoml_impl/serde.py:202` processes the request 3. `form = await request.form()` parses…</p> <p><strong>Affected:</strong> PyPI: bentoml</p> <p>### Description</p> <p>There&#39;s an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses.</p> <p>The framework automatically registers any service endpoint with file-type parameters (`pathlib.Path`, `PIL.Image.Image`) as vulnerable to this attack, making it a framework-wide security issue that affects most real-world ML services handling file uploads. While BentoML implements basic URL scheme validation in the `JSONSerde` path, the `MultipartSerde` path has no validation whatsoever, and neither path restricts access to internal networks, cloud metadata endpoints, or localhost services.</p> <p>The documentation explicitly promotes this URL-based file upload feature, making it an intended but insecure design that exposes all deployed services to SSRF attacks by default.</p> <p>### Source - Sink Analysis</p> <p>**Source:** User-controlled multipart form field values and JSON request bodies containing URLs</p> <p>**Call Chain - Path 1 (MultipartSerde - No Validation):** 1. HTTP POST request with multipart form data to any BentoML endpoint with file-type input parameters 2. `MultipartSerde.parse_request()` in `src/_bentoml_impl/serde.py:202` processes the request 3. `form = await request.form()` parses…</p> https://cve.radiocsirt.org/vuln/ghsa-mrmq-3q62-6cc8 https://cve.radiocsirt.org/vuln/pysec-2026-297 <p><strong>Affected:</strong> PyPI: bentoml</p> <p>### Description</p> <p>There&#39;s an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses.</p> <p>The framework automatically registers any service endpoint with file-type parameters (`pathlib.Path`, `PIL.Image.Image`) as vulnerable to this attack, making it a framework-wide security issue that affects most real-world ML services handling file uploads. While BentoML implements basic URL scheme validation in the `JSONSerde` path, the `MultipartSerde` path has no validation whatsoever, and neither path restricts access to internal networks, cloud metadata endpoints, or localhost services.</p> <p>The documentation explicitly promotes this URL-based file upload feature, making it an intended but insecure design that exposes all deployed services to SSRF attacks by default. ### Source - Sink Analysis</p> <p>**Source:** User-controlled multipart form field values and JSON request bodies containing URLs</p> <p>**Call Chain - Path 1 (MultipartSerde - No Validation):** 1. HTTP POST request with multipart form data to any BentoML endpoint with file-type input parameters 2. `MultipartSerde.parse_request()` in `src/_bentoml_impl/serde.py:202` processes the request 3. `form = await request.form()` pars…</p> <p><strong>Affected:</strong> PyPI: bentoml</p> <p>### Description</p> <p>There&#39;s an SSRF in the file upload processing system that allows remote attackers to make arbitrary HTTP requests from the server without authentication. The vulnerability exists in the serialization/deserialization handlers for multipart form data and JSON requests, which automatically download files from user-provided URLs without proper validation of internal network addresses.</p> <p>The framework automatically registers any service endpoint with file-type parameters (`pathlib.Path`, `PIL.Image.Image`) as vulnerable to this attack, making it a framework-wide security issue that affects most real-world ML services handling file uploads. While BentoML implements basic URL scheme validation in the `JSONSerde` path, the `MultipartSerde` path has no validation whatsoever, and neither path restricts access to internal networks, cloud metadata endpoints, or localhost services.</p> <p>The documentation explicitly promotes this URL-based file upload feature, making it an intended but insecure design that exposes all deployed services to SSRF attacks by default. ### Source - Sink Analysis</p> <p>**Source:** User-controlled multipart form field values and JSON request bodies containing URLs</p> <p>**Call Chain - Path 1 (MultipartSerde - No Validation):** 1. HTTP POST request with multipart form data to any BentoML endpoint with file-type input parameters 2. `MultipartSerde.parse_request()` in `src/_bentoml_impl/serde.py:202` processes the request 3. `form = await request.form()` pars…</p> https://cve.radiocsirt.org/vuln/pysec-2026-297