CVE-2025-24794Medium· 6.7▾ Sunlitsnowflake-connector-python vulnerable to insecure deserialization of the OCSP response cache
▾ Sunlit zone — Low / medium · no exploitation signal
impact 36.9 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 12.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via OSV
Last analysed / modified upstream
0.3%
Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation.
This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.
The OCSP response cache is saved locally on the machine running the Connector using the pickle serialization format. This can potentially lead to local privilege escalation if an attacker has write access to the OCSP response cache file.
Snowflake released version 3.13.1 of the Snowflake Connector for Python, which fixes this issue. We recommend users upgrade to version 3.13.1.
If you discover a security vulnerability in one of our products or websites, please report the issue to HackerOne. For more information, please see our Vulnerability Disclosure Policy.
snowflake-connector-python >= 2.7.12, < 3.13.1Upgrade to a patched release:
snowflake-connector-python 3.13.1Connected by shared product, vendor, weakness, or advisory.
CVE-2025-24795Medium· 4.4snowflake-connector-python vulnerable to insecure cache files permissions
CVE-2025-24793High· 7.0snowflake-connector-python vulnerable to SQL Injection in write_pandas
CVE-2024-49750Medium· 5.5The Snowflake Connector for Python stores sensitive data in logs
CVE-2026-15925CriticalSnowflake Connector for Python improperly verifies TLS hostnames
CVE-2022-42965Medium· 5.9snowflake-connector-python is vulnerable to Regular Expression Denial of Service (ReDoS)
CVE-2026-85525High· 7.4Improper OCSP response validation in the Snowflake Python, Go, JDBC, and Node.js drivers allowed a revoked TLS certificate to be accepted as valid, because OCSP responses were not reliably bound to the certificate being validated and def…