{"id":"CVE-2024-10190","aliases":["GHSA-mrhh-3ggq-23p2","PYSEC-2026-355"],"url":"https://o3.security/vulnerability/CVE-2024-10190","summary":"Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod","details":"Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.","published":"2025-03-20T10:09:52.689Z","modified":"2026-08-12T03:51:33.472615506Z","cvss":{"score":9.8,"severity":"CRITICAL","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"PyPI","name":"horovod","fixedVersion":null}],"fix":null,"references":[{"type":"WEB","url":"https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/10xxx/CVE-2024-10190.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-10190"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-12T03:51:33.472615506Z"}}