GitHub Advisoryadvisory · PyPI

GHSA-f4hp-rmr7-r7v8 PyTorch is Vulnerable to Memory Consumption through pad_packed_sequence Function

MEDIUM Published 2025-03-31 Modified 2026-06-09 Official page ↗
Aliases
CVE-2025-2998
Ecosystem
PyPI
Packages
torch
Severity
Moderate
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-119
Reviewed
2026-06-09

Affected packages

• PyPI torch: <= 2.6.0 (no fix yet)

Description

A vulnerability was found in PyTorch 2.6.0. It has been declared as critical. Affected by this vulnerability is the function torch.nn.utils.rnn.pad_packed_sequence. The manipulation leads to memory corruption. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used.

Related

Alias · CVE (1)

  • CVE-2025-2998 A vulnerability was found in PyTorch 2.6.0. vulnerability

Weakness · CWE (1)

  • CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer weakness

References