What is CVE-2025-24794?

CVE-2025-24794 is a medium-severity vulnerability in Snowflake Connector, classified under Deserialization of Untrusted Data. CVSS score: 6.7/10. Published 2025-01-29.

How severe is CVE-2025-24794?

Medium severity. CVSS v3 base score is 6.7 out of 10.

Is CVE-2025-24794 known to be exploited?

1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.

Deserialization in Snowflake Connector

CVE-2025-24794

The Snowflake Connector for Python provides an interface for developing Python applications that can connect to Snowflake and perform all standard operations. Snowflake discovered and remediated a vulnerability in the Snowflake Connector for Python. The OCSP response cache uses pickle as the serialization format, potentially leading to local privilege escalation. This vulnerability affects versions 2.7.12 through 3.13.0. Snowflake fixed the issue in version 3.13.1.

Vulnerability class: Insecure Deserialization

EPSS: 0.002 (16.0th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 6.7 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Affected products

Snowflake Snowflake_connector
Snowflakedb Snowflake-connector-python — versions >= 2.7.12, < 3.13.1

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

Public proof-of-concept exploits

DependencyTrack/vuln-db

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)

Frequently asked questions

What is CVE-2025-24794?: CVE-2025-24794 is a medium-severity vulnerability in Snowflake Connector, classified under Deserialization of Untrusted Data. CVSS score: 6.7/10. Published 2025-01-29.
How severe is CVE-2025-24794?: Medium severity. CVSS v3 base score is 6.7 out of 10.
Is CVE-2025-24794 known to be exploited?: 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.