GitHub Advisoryadvisory · PyPI

GHSA-3749-ghw9-m3mg PyTorch susceptible to local Denial of Service

LOW Published 2025-03-30 Modified 2026-06-08 Official page ↗
Aliases
CVE-2025-2953
Ecosystem
PyPI
Packages
torch
Severity
Low
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
Weaknesses
CWE-404
Reviewed
2025-04-15

Affected packages

• PyPI torch: < 2.7.1-rc1 → fixed in 2.7.1-rc1

Description

A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. Affected by this issue is the function torch.mkldnn_max_pool2d. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-2953 A vulnerability, which was classified as problematic, has been found in PyTorch 2.6.0+cu124. vulnerability

Weakness · CWE (1)

  • CWE-404 Improper Resource Shutdown or Release weakness

References