GHSA-r5x9-822m-2crgHighCVSS 8.2
Apache Airflow did not reject reserved serialization keys inside a Dag run's `conf`. A user...
🔗 CVE IDs covered (1)
📋 Description
Apache Airflow did not reject reserved serialization keys inside a Dag run's conf. A user allowed to trigger a Dag that uses a deadline alert with an asynchronous callback could pass a conf that, once the deadline was missed, either crashed the scheduler repeatedly or was rebuilt into objects inside the Triggerer. Users are advised to upgrade to apache-airflow 3.4.0 or later.