CVE-2022-34668 NVFLARE unsafe deserialization due to Pickle

What is CVE-2022-34668?

CVE-2022-34668 is a critical unsafe deserialization vulnerability in NVIDIA FLARE, published on 29 Aug 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

NVFLARE, versions prior to 2.1.4, contains a vulnerability that deserialization of Untrusted Data due to Pickle usage may allow an unprivileged network attacker to cause Remote Code Execution, Denial Of Service, and Impact to both Confidentiality and Integrity.

Weakness: CWE-502

Which versions are affected by CVE-2022-34668?

3 open source packages ship an affected version, including nvflare. It affects 1 product.

Products include Nvidia Nvflare.

How do I fix CVE-2022-34668?

Upgrade nvflare to 2.1.4 or later.

Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.

Is CVE-2022-34668 being exploited?

There is no known exploitation of CVE-2022-34668 in the wild and no public exploit code.

Public exploit code: 1 Exploit-DB entry.

Other vulnerabilities in NVIDIA FLARE

• CVE-2026-24178 NVIDIA NVFlare Dashboard: Authorization bypass through user-controlled key via user management and authentication system Critical 9.8
• CVE-2022-31604 Unsafe deserialisation in the PKI implementation scheme of NVFlare Critical 9.8
• CVE-2022-31605 Unsafe yaml deserialization in NVFlare Critical 9.8
• CVE-2026-24186 Deserialization in FLARE SDK High 8.8
• CVE-2026-24204 Path traversal in FLARE SDK Medium 6.5

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-6qv6-q77g-7qm6, PYSEC-2022-257.