CVE-2025-3730: PyTorch LossCTC.cpp torch.nn.functional.ctc_loss denial of service
First published: Wed Apr 16 2025(Updated: )
A vulnerability, which was classified as problematic, was found in PyTorch 2.6.0. Affected is the function torch.nn.functional.ctc_loss of the file aten/src/ATen/native/LossCTC.cpp. The manipulation leads to denial of service. An attack has to be approached locally. The exploit has been disclosed to the public and may be used. The name of the patch is 46fc5d8e360127361211cb237d5f9eef0223e567. It is recommended to apply a patch to fix this issue.
Credit: cna@vuldb.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PyTorch | ||
| pip/torch | <=2.6.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://vuldb.com/?id.305076
- https://vuldb.com/?ctiid.305076
- https://vuldb.com/?submit.553645
- https://github.com/pytorch/pytorch/issues/150835
- https://github.com/pytorch/pytorch/pull/150981
- https://github.com/pytorch/pytorch/issues/150835#issue-2979082232
- https://github.com/timocafe/tewart-pytorch/commit/46fc5d8e360127361211cb237d5f9eef0223e567
- https://nvd.nist.gov/vuln/detail/CVE-2025-3730
- https://github.com/pytorch/pytorch/commit/01f226bfb8f2c343f5c614a6bbf685d91160f3af
- https://github.com/advisories/GHSA-887c-mr87-cxwp (Advisory)
Frequently Asked Questions
What is the severity of CVE-2025-3730?
CVE-2025-3730 is classified as a problematic vulnerability with the potential for a denial of service.
How does CVE-2025-3730 affect PyTorch?
CVE-2025-3730 affects the function torch.nn.functional.ctc_loss in PyTorch and can lead to service disruptions.
Is CVE-2025-3730 exploitable remotely?
CVE-2025-3730 requires local access to exploit, meaning it cannot be exploited remotely.
When was CVE-2025-3730 discovered?
CVE-2025-3730 was reported in relation to PyTorch version 2.6.0.
How can I mitigate CVE-2025-3730?
To mitigate CVE-2025-3730, consider upgrading PyTorch to the latest version that addresses this vulnerability.
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/first-publish-date
- agent/type
- agent/title
- agent/description
- agent/guess-ai
- agent/software-canonical-lookup
- collector/nvd-api
- source/NVD
- agent/author
- agent/severity
- agent/references
- agent/last-modified-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-887c-mr87-cxwp
- alias/CVE-2025-3730
- agent/softwarecombine
- agent/event
- collector/nvd-cve
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/pytorch
- canonical/pytorch
- package-manager/pip