# CVE-2025-27520: BentoML Allows Remote Code Execution (RCE) via Insecure Deserialization

- Exploited (CISA KEV): no
- Published: 2025-04-04
- CVSS: 9.8 CRITICAL (v3.1)
- EPSS: 40.6% (99th percentile)
- CWE: CWE-502

BentoML is a Python library for building online serving systems optimized for AI apps and model inference. A Remote Code Execution (RCE) vulnerability caused by insecure deserialization has been identified in the latest version (v1.4.2) of BentoML. It allows any unauthenticated user to execute arbitrary code on the server. It exists an unsafe code segment in serde.py. This vulnerability is fixed in 1.4.3.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Rule off by default | 2025-05-19 | 45 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-05-19 · new · rule 2e6bb954d0634e368c49d7d1d7619ccb · default Disabled
  > BentoML - Remote Code Execution - CVE:CVE-2025-27520. Previous action: Log. New action: Disabled. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-05-19-waf-release/

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2025-27520 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2025-27520