CVE-2026-92785

CVSS 9.2 (critical) · published 2026-09-16

Angel through 3.3.0 deserializes untrusted setAlgoMetrics payload using Kryo without class registration or allowlist validation. Unauthenticated network attackers can instantiate arbitrary classes or exhaust coordinator memory by sending crafted serialized objects to the master RPC endpoint.

Weakness: CWE-502

Source: NVD CVE-2026-92785

References

• https://github.com/Angel-ML/angel
• https://github.com/Angel-ML/angel/blob/Release-3.3.0/angel-ps/core/src/main/java/com/tencent/angel/utils/KryoUtils.java#L45-L70
• https://github.com/Angel-ML/angel/issues/1355
• https://www.vulncheck.com/advisories/angel-through-3.3.0-unauthenticated-kryo-deserialization-of-arbitrary-classes
• https://github.com/Angel-ML/angel/issues/1355

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.