Critical severity9.8NVD Advisory· Published Mar 20, 2025· Updated Jun 17, 2026
CVE-2024-10190
CVE-2024-10190
Description
Horovod versions up to and including v0.28.1 are vulnerable to unauthenticated remote code execution. The vulnerability is due to improper handling of base64-encoded data in the ElasticRendezvousHandler, a subclass of KVStoreHandler. Specifically, the _put_value method in ElasticRendezvousHandler calls codec.loads_base64(value), which eventually invokes cloudpickle.loads(decoded). This allows an attacker to send a malicious pickle object via a PUT request, leading to arbitrary code execution on the server.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
horovodPyPI | <= 0.28.1 | — |
Affected products
3Patches
Vulnerability mechanics
References
3- huntr.com/bounties/3e398d1f-70c2-4e05-ae22-f5d66b19a754nvdExploitIssue TrackingThird Party AdvisoryWEB
- github.com/advisories/GHSA-mrhh-3ggq-23p2ghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2024-10190ghsaADVISORY
News mentions
0No linked articles in our index yet.