torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl: 20 vulnerabilities (highest severity is: 7.5)

[mend-bolt-for-github[bot]]

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Vulnerabilities

Vulnerability	Severity	CVSS	Dependency	Type	Fixed in (torch version)	Remediation Possible**
CVE-2025-55560	High	7.5	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.8.0	❌
CVE-2025-55558	High	7.5	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.8.0	❌
CVE-2025-55557	High	7.5	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.8.0	❌
CVE-2025-55553	High	7.5	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.8.0	❌
CVE-2025-55552	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-46153	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.7.0	❌
CVE-2025-46150	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.7.0	❌
CVE-2025-46149	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	2.7.0	❌
CVE-2025-3001	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-3000	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-2999	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-2998	Medium	5.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-2148	Medium	5.0	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-63396	Low	3.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-4287	Low	3.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-3730	Low	3.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	torch - 2.8.0	❌
CVE-2025-3136	Low	3.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-3121	Low	3.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-2953	Low	3.3	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌
CVE-2025-2149	Low	2.5	torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl	Direct	N/A	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2025-55560

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

An issue in pytorch v2.7.0 can lead to a Denial of Service (DoS) when a PyTorch model consists of torch.Tensor.to_sparse() and torch.Tensor.to_dense() and is compiled by Inductor.

Publish Date: 2025-09-25

URL: CVE-2025-55560

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.8.0

Step up your Open Source Security Game with Mend here

CVE-2025-55558

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A buffer overflow occurs in pytorch v2.7.0 when a PyTorch model consists of torch.nn.Conv2d, torch.nn.functional.hardshrink, and torch.Tensor.view-torch.mv() and is compiled by Inductor, leading to a Denial of Service (DoS).

Publish Date: 2025-09-25

URL: CVE-2025-55558

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.8.0

Step up your Open Source Security Game with Mend here

CVE-2025-55557

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A Name Error occurs in pytorch v2.7.0 when a PyTorch model consists of torch.cummin and is compiled by Inductor, leading to a Denial of Service (DoS).

Publish Date: 2025-09-25

URL: CVE-2025-55557

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.8.0

Step up your Open Source Security Game with Mend here

CVE-2025-55553

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A syntax error in the component proxy_tensor.py of pytorch v2.7.0 allows attackers to cause a Denial of Service (DoS).

Publish Date: 2025-09-25

URL: CVE-2025-55553

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.8.0

Step up your Open Source Security Game with Mend here

CVE-2025-55552

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

pytorch v2.8.0 was discovered to display unexpected behavior when the components torch.rot90 and torch.randn_like are used together.

Publish Date: 2025-09-25

URL: CVE-2025-55552

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-46153

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

PyTorch before 3.7.0 has a bernoulli_p decompose function in decompositions.py even though it lacks full consistency with the eager CPU implementation, negatively affecting nn.Dropout1d, nn.Dropout2d, and nn.Dropout3d for fallback_random=True.

Publish Date: 2025-09-25

URL: CVE-2025-46153

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.7.0

Step up your Open Source Security Game with Mend here

CVE-2025-46150

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

In PyTorch before 2.7.0, when torch.compile is used, FractionalMaxPool2d has inconsistent results.

Publish Date: 2025-09-25

URL: CVE-2025-46150

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.7.0

Step up your Open Source Security Game with Mend here

CVE-2025-46149

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

In PyTorch before 2.7.0, when inductor is used, nn.Fold has an assertion error.

Publish Date: 2025-09-25

URL: CVE-2025-46149

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2025-09-25

Fix Resolution: 2.7.0

Step up your Open Source Security Game with Mend here

CVE-2025-3001

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability classified as critical was found in PyTorch 2.6.0. This vulnerability affects the function torch.lstm_cell. The manipulation leads to memory corruption. The attack needs to be approached locally. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-03-31

URL: CVE-2025-3001

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-3000

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability classified as critical has been found in PyTorch 2.6.0. This affects the function torch.jit.script. The manipulation leads to memory corruption. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-03-31

URL: CVE-2025-3000

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-2999

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability was found in PyTorch 2.6.0. It has been rated as critical. Affected by this issue is the function torch.nn.utils.rnn.unpack_sequence. The manipulation leads to memory corruption. Attacking locally is a requirement. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-03-31

URL: CVE-2025-2999

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-2998

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-03-31

URL: CVE-2025-2998

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-2148

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability was found in PyTorch 2.6.0+cu124. It has been declared as critical. Affected by this vulnerability is the function torch.ops.profiler._call_end_callbacks_on_jit_fut of the component Tuple Handler. The manipulation of the argument None leads to memory corruption. The attack can be launched remotely. The complexity of an attack is rather high. The exploitation appears to be difficult.

Publish Date: 2025-03-10

URL: CVE-2025-2148

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-63396

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

An issue was discovered in PyTorch v2.5 and v2.7.1. Omission of profiler.stop() can cause torch.profiler.profile (PythonTracer) to crash or hang during finalization, leading to a Denial of Service (DoS).

Publish Date: 2025-11-12

URL: CVE-2025-63396

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-4287

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function torch.cuda.nccl.reduce of the file torch/cuda/nccl.py. The manipulation leads to denial of service. It is possible to launch the attack on the local host. The exploit has been disclosed to the public and may be used. The patch is identified as 5827d2061dcb4acd05ac5f8e65d8693a481ba0f5. It is recommended to apply a patch to fix this issue.

Publish Date: 2025-05-05

URL: CVE-2025-4287

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-3730

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue. The security policy of the project warns to use unknown models which might establish malicious effects.

Publish Date: 2025-04-16

URL: CVE-2025-3730

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-887c-mr87-cxwp

Release Date: 2025-04-16

Fix Resolution: torch - 2.8.0

Step up your Open Source Security Game with Mend here

CVE-2025-3136

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0. This issue affects the function torch.cuda.memory.caching_allocator_delete of the file c10/cuda/CUDACachingAllocator.cpp. The manipulation leads to memory corruption. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-04-03

URL: CVE-2025-3136

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-3121

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability classified as problematic has been found in PyTorch 2.6.0. Affected is the function torch.jit.jit_module_from_flatbuffer. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-04-02

URL: CVE-2025-3121

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-2953

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The real existence of this vulnerability is still doubted at the moment. The security policy of the project warns to use unknown models which might establish malicious effects.

Publish Date: 2025-03-30

URL: CVE-2025-2953

CVSS 3 Score Details (3.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2025-2149

Vulnerable Library - torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Tensors and Dynamic neural networks in Python with strong GPU acceleration

Library home page: https://files.pythonhosted.org/packages/40/bb/feb5644baa621fd8e1e88bf51f6fa38ab3f985d472a764144ff4867ac1d6/torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl

Path to dependency file: /requirements.txt

Path to vulnerable library: /requirements.txt

Dependency Hierarchy:

• :x: torch-2.6.0-cp39-cp39-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 2ed3e6d266405677eb45c15a472c288b604a1cad

Found in base branch: main

Vulnerability Details

A vulnerability was found in PyTorch 2.6.0+cu124. It has been rated as problematic. Affected by this issue is the function nnq_Sigmoid of the component Quantized Sigmoid Module. The manipulation of the argument scale/zero_point leads to improper initialization. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The exploit has been disclosed to the public and may be used.

Publish Date: 2025-03-10

URL: CVE-2025-2149

CVSS 3 Score Details (2.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here