CVE-2024-10190

Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the `ElasticRendezvousHandler`, a subclass of `KVStoreHandler`. Specifically, the `_put_value` method in `ElasticRendezvousHandler` calls `codec.loads_base64(value)`, which eventually invokes `cloudpickle.loads(decoded)`. This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.

Score

CVSS 3.0 9.8 Critical

Status

Analyzed - security@huntr.dev

Published

2025-03-20

Last modified

2025-10-15

Weaknesses

CWE-502

Affected products

• Horovod (Horovod)
• Horovodhorovod (Horovod)

References

• https://huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754