Vulnerability Description
Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.
CVSS Score
HIGH
Related Weaknesses (CWE)
References
- https://github.com/Angel-ML/angel
- https://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java
- https://github.com/Angel-ML/angel/issues/1355
- https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-de
- https://github.com/Angel-ML/angel/issues/1355
FAQ
What is CVE-2026-92785?
CVE-2026-92785 is a vulnerability with a CVSS score of 8.1 (HIGH). Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or ...
How severe is CVE-2026-92785?
CVE-2026-92785 has been rated HIGH with a CVSS base score of 8.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-92785?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.