CVE-2025-2953

CVE-2025-2953 affects PyTorch 2.6.0+cu124, specifically the mkldnn_max_pool2d function. The issue can lead to denial of service via local access, with an exploit publicly disclosed and the vulnerability’s real existence doubted in the description. The connected IBM bulletin references PyTorch in ...

Improper Resource Shutdown or Release

Overview torch is a Tensors and Dynamic neural networks in Python with strong GPU acceleration Affected versions of this package are vulnerable to Improper Resource Shutdown or Release via the torch.mkldnnmaxpool2d function. An attacker can disrupt service by exploiting this vulnerability locally...

CVE-2025-2953

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be...

CVE-2025-2953 PyTorch torch.mkldnn_max_pool2d denial of service

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be...

CVE-2025-2953 PyTorch torch.mkldnn_max_pool2d denial of service

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be...

CVE-2025-2953

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be...

PT-2025-13623

Name of the Vulnerable Software and Affected Versions PyTorch version 2.6.0+cu124 Description A problematic issue has been found, affecting the function torch.mkldnn max pool2d, which can lead to denial of service. The manipulation requires a local approach. Recommendations For PyTorch version...

CVE-2025-2953: Improper Resource Shutdown or Release

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnnmaxpool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be...

PyTorch security vulnerabilities

PyTorch is a Python package open-sourced by PyTorch. PyTorch suffers from a denial of service vulnerability caused by a floating point exception in the function torch.mkldnnmaxpool2d. An attacker can exploit this vulnerability to cause a denial of service...

CBL Mariner 2.0 Security Update: pytorch (CVE-2024-31580)

The version of pytorch installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-31580 advisory. - PyTorch before v2.2.0 was discovered to contain a heap buffer overflow vulnerability in the component...

Pytorch-Lightning Code Issue Vulnerability

Pytorch-Lightning is an open source lightweight PyTorch wrapper from Lightning AI open source in the US. Used for high performance Ai research. Pytorch-Lightning suffers from a code issue vulnerability that stems from the application's lack of effective validation of uploaded files. An attacker c...

Security Bulletin: IBM Maximo Application Suite Ai-Broker Component vulnerable to PyTorch to execute arbitrary code on the system.

Summary Security Bulletin: IBM Maximo Application Suite Ai-Broker Component may be vulnerable to PyTorch arbitrary code execution of Python code through the use of torch. This bulletin contains information regarding the vulnerability and its fixture. Vulnerability Details CVEID:CVE-2024-48063...

CVE-2024-6577

In the latest version of pytorch/serve, the script 'uploadresultstos3.sh' references the S3 bucket 'benchmarkai-metrics-prod' without ensuring its ownership or confirming its accessibility. This could lead to potential security vulnerabilities or unauthorized access to the bucket if it is not...

CVE-2024-7804

A flaw was found in PyTorch. This vulnerability allows an attacker to execute arbitrary code remotely via a maliciously crafted serialized PythonUDF object. Mitigation Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security...

CVE-2024-8019

In lightning-ai/pytorch-lightning version 2.3.2, a vulnerability exists in the LightningApp when running on a Windows host. The vulnerability occurs at the /api/v1/uploadfile/ endpoint, allowing an attacker to write or overwrite arbitrary files by providing a crafted filename. This can lead to...

CVE-2024-8020

A flaw was found in PyTorch Lightning. This vulnerability allows an attacker to cause a denial of service via an unexpected POST request to the /api/v1/state endpoint, leading to improper handling of state values and server shutdown. Mitigation Implementing an input validation on the server-side...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-1474 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-1474 Source advisory: OSV:GHSA-4RJ2-9GCX-5QHX...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2025-0453 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2025-0453 Source advisory: OSV:GHSA-49M6-VRR9-2CQM...

pytorch-vision-classifier (>=0.0.4, <=0.0.8), train-and-deploy (>=0.1.1a0, <=0.1.4) +2 more potentially affected by CVE-2024-8859 via mlflow (1.10.0)

mlflow PYPI version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on mlflow and may be impacted: - pytorch-vision-classifier =0.0.4, =0.1.1a0, =0.4.1, =0.4.2 - waveletai 0.2.4 Source cves: CVE-2024-8859 Source advisory: OSV:GHSA-4RQF-8PFM-P36R...

mimikit (>=0.2.3, <=0.2.6) potentially affected by CVE-2024-8020 via pytorch-lightning (1.2.4)

pytorch-lightning PYPI version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on pytorch-lightning and may be impacted: - mimikit =0.2.3, =0.2.6 Source cves: CVE-2024-8020 Source advisory: OSV:GHSA-98FP-7V67-4V3Q...