Approved changes feed: RSS · Atom
cpe:2.3:a:anyscale,_inc:ray:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Anyscale, Inc (60e4f303-7501-55fc-bf0a-e02e3e400c0b) |
|---|---|
| Product | Ray (7d342cb4-aca4-56d7-9f80-dc3711c35416) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-57516 |
vulnerable | 2026-07-29 01:00:29.839892 |
Ray < 2.56.0 Unsafe Deserialization RCE via WebDataset Reader
HIGH (8.8)
Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webdataset_datasource.py unconditionally calls pickle.loads() on tar entries with .pkl/.pickle extensions and torch.load() with weights_only=False on .pt/.pth entries, executing arbitrary code inside Ray remote workers on every worker that processes the malicious archive.
Published: 2026-07-01T16:36:55.765Z
Updated: 2026-10-08T15:23:28.496Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.