BentoML runner-server insecure deserialization RCE (CVE-2025-32375)
Date: 2025
Affected: BentoML <1.4.8
Attack vector: deserialization
Category: vulnerability-disclosure
Severity: Critical

BentoML <1.4.8 has insecure deserialization in the runner-server allowing attackers to execute arbitrary code via crafted headers and parameters in POST requests.


Mitigations:

Architectural layers (MAESTRO):