Angel-ML vulnerabilities and threats

Angel-ML angel versions up to 3.3.0 are vulnerable to deserialization of untrusted data via the Kryo serialization framework. This allows unauthenticated network attackers to send crafted serialized objects to the master RPC endpoint, potentially instantiating arbitrary classes or exhausting coordinator memory. The vulnerability arises because deserialization occurs without class registration or allowlist validation.