What’s Vulnerable › Vulnerabilities

CVE-2025-0508: MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk

• Severity: medium (CVSS 5.9 v3.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-03-20 · updated 2026-06-17
• Weakness: CWE-328

Description

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.

Affected products

• aws/sagemaker-python-sdk: before 4965 — fixed in 4965

How to fix

Upgrade to a fixed version: aws/sagemaker-python-sdk 4965. Check the vendor advisory for mitigations.

References

• https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
• https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2

Get alerted when CVE-2025-0508 or the next vulnerability affects your stack