CVE-2026-92785 | BDVDB-2026-375498 Detail
Angel-MLangel
Description#
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-502 Deserialization of Untrusted Data
References#
- https://github.com/Angel-ML/angel/issues/1355
- https://github.com/Angel-ML/angel
- https://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70
- https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.