CVE-2024-35198: TorchServe vulnerable to bypass of allowed_urls configuration
Summary
CVE-2024-35198: TorchServe vulnerable to bypass of allowed_urls configuration. Affects torchserve versions < 0.11.0. Fixed in 0.11.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
TorchServe is an open-source model serving library for PyTorch. It allows users to deploy trained PyTorch models for inference in a production environment. TorchServe provides various features such as model versioning, multi-model serving, and RESTful APIs. However, a vulnerability has been identified in TorchServe that allows bypassing of the allowed_urls configuration.
Vulnerability Detail
The vulnerability in TorchServe allows the bypassing of the allowed_urls configuration. This means that even if the allowed_urls configuration is set to restrict certain URLs, it can be bypassed if the URL contains characters such as "..". This bypass allows the model to be downloaded into the model store without proper validation. Once the file is downloaded, it can be referenced without providing a URL, effectively bypassing the allowed_urls security check. It is important to note that this vulnerability does not affect customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS.
How To Fix
Latest published version: 0.12.0 as of 22 Oct 2026
pip install --upgrade "torchserve==0.12.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.11.0
This is the first release that contains the fix.
pip install --upgrade "torchserve==0.11.0"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
TorchServe, an open-source model serving library for PyTorch, was found to have a vulnerability that allowed bypassing of the allowed_urls configuration. This vulnerability has been fixed in version 0.11.0. Users are advised to update their TorchServe installation to the latest version to mitigate the risk of unauthorized access to the model store.
See every vulnerability recorded for torchserve →
FAQ
TorchServe is an open-source model serving library for PyTorch. It allows users to deploy trained PyTorch models for inference in a production environment.
The impact of this vulnerability is that the allowed_urls configuration in TorchServe can be bypassed, allowing unauthorized access to the model store and potential misuse of the downloaded models.
Users of TorchServe versions prior to 0.11.0 are affected by this vulnerability. Customers using PyTorch inference Deep Learning Containers (DLC) through Amazon SageMaker and EKS are not affected.
To fix this vulnerability, users should update their TorchServe installation to version 0.11.0 or later.
There are no specific workarounds mentioned for this vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for torchserve.
