---
id: CVE-2025-0508
aliases:
  - GHSA-32g6-mg92-ghm2
  - PYSEC-2026-1885
title: SageMaker Workflow component allows possibility of MD5 hash collisions
summary: SageMaker Workflow component allows possibility of MD5 hash collisions
severity: medium
cvss: 5.9
cvssVector: 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N'
vendor: sagemaker
product: sagemaker
ecosystem: pip
affected:
  - sagemaker < 2.237.3
patched:
  - sagemaker 2.237.3
published: '2025-03-20'
updated: '2026-07-07'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-32g6-mg92-ghm2'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-0508'
  - url: >-
      https://github.com/aws/sagemaker-python-sdk/commit/dcdd99f911e8b1a05d19cf1ad939b0fefae47864
  - url: 'https://github.com/aws/sagemaker-python-sdk'
  - url: 'https://huntr.com/bounties/eb056818-5b81-466f-81ee-916058d34af2'
tags:
  - osv
  - pip
epss: 0.0026
epssPercentile: 0.18013
ingestedAt: '2026-07-08T18:25:44.645Z'
---

## Overview

A vulnerability in the SageMaker Workflow component of aws/sagemaker-python-sdk allows for the possibility of MD5 hash collisions in all versions. This can lead to workflows being inadvertently replaced due to the reuse of results from different configurations that produce the same MD5 hash. This issue can cause integrity problems within the pipeline, potentially leading to erroneous processing outcomes.

## Affected packages

- `sagemaker < 2.237.3`

## Remediation

Upgrade to a patched release:

- `sagemaker 2.237.3`