Ray vulnerabilities

3 known vulnerabilities in Ray from Anyscale. 3 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.8 High severity

  Ray: Deserialization of Untrusted Data

  CVE-2026-57516Jul 1, 2026AnyscaleEPSS 1.09%

  Ray prior to 2.56.0 contains an unsafe deserialization vulnerability in the WebDataset reader that allows attackers to achieve remote code execution by supplying a malicious tar archive to the read_webdataset() function. The _default_decoder() function in webd

• 9.1 Critical severity

  Ray: Server-Side Request Forgery

  CVE-2023-48023Nov 28, 2023AnyscaleEPSS 35.3%

  Anyscale Ray 2.6.3 and 2.8.0 allows /log_proxy SSRF. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly controlled network environment

• 9.8 Critical severity

  ray: Server-Side Request Forgery

  CVE-2023-48022Nov 28, 2023AnyscaleEPSS 83.9%

  Anyscale Ray 2.6.3 and 2.8.0 allows a remote attacker to execute arbitrary code via the job submission API. NOTE: the vendor's position is that this report is irrelevant because Ray, as stated in its documentation, is not intended for use outside of a strictly