CVE-2024-6577

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

CVE-2024-8020

CVE-2024-8020 (lightning-ai/pytorch-lightning, v2.3.2) exposes a DoS through an unexpected POST to the LightningApp API at /api/v1/state. The root cause is improper handling of unexpected state values, which can crash the server. Public references describe a DoS by sending crafted JSON (e.g., sta...

CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2024-8020

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the "/api/v1/state" endpoint of "LightningApp". This issue occurs due to improper handling of unexpected state values, which results in the serv...

CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2024-8020 Denial of Service in lightning-ai/pytorch-lightning

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2024-8019 Arbitrary File Write/Overwrite in lightning-ai/pytorch-lightning

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2024-8019

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the "LightningApp" when running on a Windows host. The vulnerability occurs at the "/api/v1/uploadfile/" endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead t...

ablation (0.1.0), acids-msprior (>=1.0.1, <=1.1.3) +495 more potentially affected by CVE-2024-8019 via pytorch-lightning (>=0.5.3.2, <=2.3.3)

pytorch-lightning PYPI version =0.5.3.2, =1.0.1, =2.1.16, =1.3.0, =1.8.15, =1.8.17, =1.8.14, =1.0.0rc1, =0.2.2, =0.1.1, =0.1.1, =0.6.1 and more Source cves: CVE-2024-8019 Source advisory: MEND:CVE-2024-8019...

PT-2025-12163

Name of the Vulnerable Software and Affected Versions pytorch/serve affected versions not specified Description The issue concerns the script 'upload results to s3.sh' referencing the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could...

CVE-2024-8020: Uncaught Exception

A vulnerability in lightning-ai/pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occurs due to improper handling of unexpected state values, which results in the server...

CVE-2024-8019: Unrestricted Upload of File with Dangerous Type

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2024-6577: Undefined Security Weakness

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

PT-2025-12194

Name of the Vulnerable Software and Affected Versions pytorch/pytorch versions =2.3.1 Description A deserialization vulnerability exists in the Pytorch RPC framework, allowing an attacker to execute arbitrary code remotely by sending a malicious serialized PythonUDF object. This flaw leads to...

Pytorch-Lightning code issues and vulnerabilities

Pytorch-Lightning is an open source lightweight PyTorch wrapper from Lightning AI open source in the US. Used for high performance Ai research. Pytorch-Lightning suffers from a code issue vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker c...

PT-2025-12205

Name of the Vulnerable Software and Affected Versions pytorch-lightning version 2.3.2 Description A vulnerability in pytorch-lightning version 2.3.2 allows an attacker to cause a denial of service by sending an unexpected POST request to the /api/v1/state endpoint of LightningApp. This issue occu...

PT-2025-12204

Name of the Vulnerable Software and Affected Versions lightning-ai/pytorch-lightning version 2.3.2 Description A vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/upload file/ endpoint, allowing an attacker to write or overwrite...

Number withdrawal

PyTorch is a Python package in the PyTorch open source. This CVE number has been withdrawn...

PyTorch security vulnerabilities

PyTorch is a Python package open-sourced by PyTorch. PyTorch has a security vulnerability that stems from the uploadresultstos3.sh script not ensuring S3 bucket ownership, which could lead to data disclosure or unauthorized access...

CVE-2025-2149

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnqSigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zeropoint leads to improper initialization. The attack needs to be approached...