Staging Environment: Content and features may be unstable or change without notice.
Search for vulnerabilities
Vulnerability details: VCID-zr1b-b765-1kh1
Vulnerability ID VCID-zr1b-b765-1kh1
Aliases CVE-2025-0508
GHSA-32g6-mg92-ghm2
Summary A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-328 Use of Weak Hash
CWE-440 Expected Behavior Violation
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2025-0508
epss 0.00138 https://api.first.org/data/v1/epss?cve=CVE-2025-0508
cvssv3.1 5.9 https://github.com/aws/sagemaker-python-sdk
generic_textual MODERATE https://github.com/aws/sagemaker-python-sdk
cvssv3 5.9 https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
cvssv3.1 5.9 https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
generic_textual MODERATE https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
ssvc Track https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
cvssv3 5.9 https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
cvssv3.1 5.9 https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
generic_textual MODERATE https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
ssvc Track https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
cvssv3.1 5.9 https://nvd.nist.gov/vuln/detail/CVE-2025-0508
generic_textual MODERATE https://nvd.nist.gov/vuln/detail/CVE-2025-0508
Reference id Reference type URL
https://api.first.org/data/v1/epss?cve=CVE-2025-0508
https://github.com/aws/sagemaker-python-sdk
https://nvd.nist.gov/vuln/detail/CVE-2025-0508
dcdd99f911e8b1a05d19cf1ad939b0fefae47864 https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
eb056818-5b81-466f-81ee-916058d34af2 https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
GHSA-32g6-mg92-ghm2 https://github.com/advisories/GHSA-32g6-mg92-ghm2
No exploits are available.
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/aws/sagemaker-python-sdk
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-20T14:26:53Z/ Found at https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:P/A:N/T:P/P:M/B:A/M:M/D:T/2025-03-20T14:26:53Z/ Found at https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2025-0508
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.33573
EPSS Score 0.00138
Published At June 11, 2026, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2026-06-11T17:14:19.205738+00:00 Vulnrichment Import https://github.com/cisagov/vulnrichment/blob/develop/2025/0xxx/CVE-2025-0508.json 38.6.0