CVE-2025-3730: PyTorch Denial of Service Vulnerability in ctc_loss Function
Summary
CVE-2025-3730: PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service. Affects pytorch versions >= 2.6.0, < 2.7.0. Fixed in 2.7.0. How to fix ↓
Also tracked for
The same CVE-2025-3730 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyTorch is an open-source machine learning library widely used for applications such as computer vision and natural language processing. It provides a flexible platform for building and training neural networks. The library's functionality includes tensor computation, automatic differentiation, and a rich ecosystem of tools and libraries. However, like many software packages, it is susceptible to vulnerabilities that can affect its performance and security.
Vulnerability Detail
A vulnerability classified as problematic was discovered in PyTorch version 2.6.0, specifically in the function torch.nn.functional.ctc_loss located in the file aten/src/ATen/native/LossCTC.cpp. This vulnerability can lead to a denial of service, where an attacker can exploit the function to disrupt the normal operation of the application. The attack must be executed locally, and while the exploit has been publicly disclosed, its actual impact is still under scrutiny. The patch addressing this issue is identified by the commit hash 46fc5d8e360127361211cb237d5f9eef0223e567.
How To Fix
Minimum fixed version
2.7.0
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, avoid using the ctc_loss function with untrusted or unknown models, as they may exploit this vulnerability. Always validate and sanitize inputs to the function to mitigate potential risks.
Conclusion
The CVE-2025-3730 vulnerability in PyTorch's ctc_loss function poses a risk of denial of service, particularly in version 2.6.0. Users are encouraged to upgrade to version 2.7.0 or later to mitigate this risk. Additionally, employing best practices around input validation can help reduce exposure to potential exploits.
See every vulnerability recorded for pytorch →
FAQ
CVE-2025-3730 is a vulnerability in PyTorch that can lead to denial of service through the ctc_loss function.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you cannot update, ensure that you do not use the ctc_loss function with untrusted models and validate all inputs.
The vulnerability is classified as medium severity, which means it poses a significant risk but is not the highest priority for immediate action.
You can visit the official PyTorch GitHub repository or security advisories for the latest updates on vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for pytorch.
