What is CVE-2026-25632?

CVE-2026-25632 is a critical-severity vulnerability in Waterfutures Epyt-flow, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2026-02-06.

How severe is CVE-2026-25632?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Deserialization in Waterfutures Epyt-flow

CVE-2026-25632

EPyT-Flow is a Python package designed for the easy generation of hydraulic and water quality scenario data of water distribution networks. Prior to 0.16.1, EPyT-Flow’s REST API parses attacker-controlled JSON request bodies using a custom…

Vulnerability class: Insecure Deserialization

EPSS: 0.007 (46.8th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Waterfutures Epyt-flow — versions < 0.16.1

Weakness classification (CWE)

CWE-502 — Deserialization of Untrusted Data

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
security-advisories@github.com (Product, x_refsource_MISC, Release Notes)

Frequently asked questions

What is CVE-2026-25632?: CVE-2026-25632 is a critical-severity vulnerability in Waterfutures Epyt-flow, classified under Deserialization of Untrusted Data. CVSS score: 10.0/10. Published 2026-02-06.
How severe is CVE-2026-25632?: Critical severity. CVSS v3 base score is 10.0 out of 10.