PyPIPackage

horovod

3 known vulnerabilities (2 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release: 0.28.1 (Jun 12, 2023): affected by 2 advisories
Newest unaffected release: Every release is affected by at least one advisory
Advisories: 3 · 2 critical, 1 high

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2026-31234Critical 9.8
Horovod thru 0.28.1 contains an insecure deserialization vulnerability (CWE-502) in its KVStore HTTP server component.
Affected: through 0.28.1.
No fix released. The latest release, 0.28.1, is still affected.
CVE-2024-10190Critical 9.8
Unauthenticated Remote Code Execution in ElasticRendezvousHandler in horovod/horovod
Affected: through 0.28.1.
No fix released. The latest release, 0.28.1, is still affected.
CVE-2022-0315High 8.2
Insecure Temporary File in horovod/horovod
Affected: fixed in 0.24.0.
Fixed in 0.24.0 (released Mar 2, 2022, 22 days before disclosure).
The latest release, 0.28.1, is not affected.