CVE-2025-55552: High Severity Vulnerability in Bitnami PyTorch Affecting torch.rot90 and torch.randn_like
Summary
CVE-2025-55552: pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together. Affects pytorch versions < 2.8.0. No fix is published. How to fix ↓
Also tracked for
- torch · PyPI
The same CVE-2025-55552 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyTorch is an open-source machine learning library widely used for applications such as computer vision and natural language processing. Developed by the Linux Foundation, it provides a flexible platform for building deep learning models. The library is known for its dynamic computation graph and ease of use, making it a favorite among researchers and developers. However, vulnerabilities can arise in any software, and the recent discovery of CVE-2025-55552 highlights a critical issue in version 2.8.0 that affects specific functionalities.
Vulnerability Detail
The vulnerability identified as CVE-2025-55552 in PyTorch version 2.8.0 arises from unexpected behavior when using the components torch.rot90 and torch.randn_like together. This issue can lead to unintended consequences in model training and inference, potentially compromising the integrity of machine learning applications. The severity of this vulnerability is classified as high, with a CVSS score of 7.5, indicating that it poses a significant risk to users who rely on these functionalities.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the torch.rot90 and torch.randn_like functions together until the package is updated. This may involve modifying the code to separate the usage of these functions or implementing alternative methods for achieving similar functionality.
Conclusion
CVE-2025-55552 represents a significant vulnerability in Bitnami PyTorch that can affect the functionality of critical machine learning operations. Users are strongly encouraged to update their packages to mitigate risks associated with this issue. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pytorch →
FAQ
CVE-2025-55552 is a high severity vulnerability in Bitnami PyTorch that affects the functionalities of torch.rot90 and torch.randn_like.
This vulnerability can lead to unexpected behavior during model training and inference, potentially compromising the results of machine learning applications.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update the package, avoid using the affected functions together as a temporary workaround until you can apply the update.
More information can be found in the official vulnerability database at https://github.com/bitnami/vulndb/tree/main/data/pytorch/BIT-pytorch-2025-55552.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch.
