Skip to content
OpenAdvisories
Medium · 5.9 CVE-2025-0508 EUVD-2025-6837GHSA-32g6-mg92-ghm2PYSEC-2026-1885

MD5 Hash Collision in SageMaker Workflow in aws/sagemaker-python-sdk

Published Mar 20, 2025 · Updated Oct 15, 2025 · Assigned by @huntr_ai

Description

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.

Affected products

VendorProductAffectedFixed
aws aws/sagemaker-python-sdk unspecified – < 4965 4965

Affected packages

EcosystemPackageAffectedFixedRecord
PyPI sagemaker < 2.237.3 2.237.3 GHSA-32g6-mg92-ghm2

References