Angel
Monthly
Unauthenticated Kryo deserialization in the Angel-ML Angel distributed machine-learning coordinator (all versions through 3.3.0) lets any remote attacker who can reach the master RPC endpoint submit crafted setAlgoMetrics payloads that instantiate arbitrary classes or exhaust coordinator memory, producing denial of service and - when exploitable gadget classes are present on the coordinator classpath - remote code execution. No authentication or user interaction is required, but exploitation depends on network reachability to the master RPC service and, for the RCE outcome specifically, on the composition of the target's classpath; the memory-exhaustion outcome carries no such precondition and is reliably achievable. No public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the referenced GitHub issue and source-file links document the flaw but no patched release has been published.
Unauthenticated Kryo deserialization in the Angel-ML Angel distributed machine-learning coordinator (all versions through 3.3.0) lets any remote attacker who can reach the master RPC endpoint submit crafted setAlgoMetrics payloads that instantiate arbitrary classes or exhaust coordinator memory, producing denial of service and - when exploitable gadget classes are present on the coordinator classpath - remote code execution. No authentication or user interaction is required, but exploitation depends on network reachability to the master RPC service and, for the RCE outcome specifically, on the composition of the target's classpath; the memory-exhaustion outcome carries no such precondition and is reliably achievable. No public exploit identified at time of analysis, and the vulnerability is not confirmed actively exploited (no CISA KEV listing); the referenced GitHub issue and source-file links document the flaw but no patched release has been published.