Denial of Service Vulnerability in PyTorch 2.6.0: Local Exploit Risk
Summary
CVE-2025-3730: A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affects pytorch across 2 version ranges.
< 1eba9b3aa3c43f86f4a2c807ac8e12c4a7767340
< 46fc5d8e360127361211cb237d5f9eef0223e567
No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
PyTorch is an open-source machine learning library widely used for applications such as computer vision and natural language processing. It provides a flexible framework for building deep learning models and is known for its ease of use and dynamic computation graph. However, version 2.6.0 has been found to contain a vulnerability in the 'torch.nn.functional.ctc_loss' function, which could lead to denial of service if exploited.
Vulnerability Detail
A vulnerability classified as problematic was discovered in PyTorch version 2.6.0. The issue lies within the 'torch.nn.functional.ctc_loss' function located in the file 'aten/src/ATen/native/LossCTC.cpp'. This vulnerability can lead to a denial of service, meaning that an attacker could potentially disrupt the normal functioning of the application. The attack must be executed locally, and the exploit has been publicly disclosed, making it a significant concern for users of this version.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid using the 'torch.nn.functional.ctc_loss' function until the patch is applied. Additionally, running the application in a controlled environment where local access is restricted may help mitigate the risk of exploitation.
Conclusion
The vulnerability identified in PyTorch 2.6.0 poses a significant risk of denial of service if exploited locally. Users are strongly encouraged to apply the provided patch to secure their applications. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for pytorch →
FAQ
The vulnerability is a denial of service issue found in the 'torch.nn.functional.ctc_loss' function, which can be exploited locally.
You can use Vulert, which monitors open-source vulnerabilities in your software using a manifest file like package-lock.json. Visit Vulert Scanner to check your application without any signup.
As a workaround, avoid using the affected function and restrict local access to the application until the patch is applied.
Yes, the exploit for this vulnerability has been disclosed to the public, which increases the urgency for users to apply the patch.
The patch can be found in the commit history of the PyTorch GitHub repository, specifically under the commit hash '46fc5d8e360127361211cb237d5f9eef0223e567'.
Related vulnerabilities
Recent vulnerabilities recorded for pytorch.
